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ORDER FOR SUPPLIES OR SERVICES 
IMPORTANT: Mark all packages and papers with contract and/or order numbers. 


1. DATE OF ORDER 2. CONTRACT NO. (if any) 6. SHIP TO: 
08/27/2020 a. NAME OF CONSIGNEE 

3. ORDER NO. 4. REQUISITION/REFERENCE NO. CDC DISTRIBUTION CENTER (Warehouse) 
75D30120F09621 b. STREET ADDRESS 


5. ISSUING OFFICE (Address correspondence to} 3719 NORTH PEACHTREE RD, 


Centers for Disease Control and Prevention (CDC) 
Office of Acquisition Services (OAS) 


2900 Woodcock Blvd, MS TCU-4 c. CITY d. STATE | e. ZIP CODE 
Atlanta, GA 30341-4004 CHAMBLEE GA 30341-2221 
7. To: f. SHIP VIA 


a. NAME OF CONTRACTOR 
GENERAL DYNAMICS INFORMATION TECHNOLOGY, INC. 


DUNS NUMBER: 067641597 8. TYPE OF ORDER 
W OOMPANY NAME a. PURCHASE [F] > DELIVERY 
ERENCE YOUR: ame 6 , 

2 STREET ADDRESS Except for billing instructions on the 

Please furnish the lollowing on the terms | reverse, this delivery order is subject to 
3150 FAIRVIEW PARK DR STE 100 and conditions specified on both sides of | instructions contained on this side only 
d CITY e STATE ZIP CODE this order and on the attached sheet, if | of this form and is issued subject to the 

any, including delivery as indicated. terms and conditions of the above- 
PALLS CHURCH VA 22042-4504 numbered contract. 
9. ACCOUNTING AND APPROPRIATION DATA 10. REQUISITIONING OFFICE 
See Section B HCVG1A 


11. BUSINESS CLASSIFICATION (Check appropriate box{es)} 
a. SMALL E b. OTHER THAN SMALL c. DISADVANTAGED ] d. WOMEN-OWNED 


12. F.0.B. POINT 14. GOVERNMENT B/L NO. 15. DELIVER TO F.0.B. POINT 16. DISCOUNT TERMS 
Destination ON OR BEFORE (Date) 


13. PLACE OF 08/26/2022 Net 30 Days 


b. ACCEPTANCE 


a. INSPECTION 


17. SCHEDULE (See reverse for Rejections 


QUANTITY UNIT QUANTITY 
ITEM NO. SUPPLIES OR SERVICES ORDERED UNIT PRICE AMOUNT ACCEPTED 
fa) (b) lo) id) (e) yi (9) 


The Centers for Disease Control and 
Prevention (CDC) and the US Food and Drug 
Administration (FDA) have a requirement 
for technical and programmatic support 
related to the Vaccine Adverse Event 
Reporting System (VAERS) SARS-CoV-2 
vaccines. This task order will be placed 
on GSA Alliant 2. 

OFR/OAS: Lindsey Crockett, ywnl@cde.gov, 
770.488.2815 

COR: Traci Sinetta Roberts, xct6@cdc.gov, 
404.498.0669 

CTR: 


18. SHIPPING POINT 19. GROSS SHIPPING WEIGHT 20. INVOICE NO. 
17(h) TOT, 


21. MAIL INVOICE TO: DA (Cont. 
SEE BILLING a. NAME pages) 
eo Centers for Disease Control and Prevention (FMO) 


REVERSE b. STREET ADDRESS for P.O. Box) 
PO Box 15580 404-718-8100 aoe 
c. CITY d. STATE | e. ZIP CODE (b)(4) TOTAL 
Atlanta GA 303330080 
Digitally signed by Philip Denis- | 23- NAME (Typed) 


22. UNITED STATES Philip Denis -S s 


OF AMERICA (Signature) Date: 2020.08.26 16:24:28 -04'00' 
TITLE: GCONTRACTING/ORDERING OFFICER 


NSN 7540-01-152-8083 OPTIONAL FORM 347 (REV. 6/95) 
PREVIOUS EDITION NOT USABLE Prescribed by GSA/FAR 48 CFR 53.213(e) 


SUPPLEMENTAL INVOICING INFORMATION 


If desired, this order (or a copy thereof) may be used by the Contractor as the Contractor's invoice, instead of a separate invoice, provided the following 
statement, (signed and dated) is on (or attached to) the order: “Payment is requested in the amount of $ . No other invoice will be submitted.” 
However, if the Contractor wishes to submit an invoice, the following information must be provided: contract number (if any), order number, item 
number(s), description of supplies or service, sizes, quantities, unit prices, and extended totals. Prepaid shipping costs will be indicated as a separate 
item on the invoice. Where shipping costs exceed $10 (except for parce! post), the billing must be supported by a bill of lading or receipt. When several 
orders are invoiced to an ordering activity during the same billing period, consolidated periodic billings are encouraged. 


RECEIVING REPOAT 


Quantity in the "Quantity Accepted” column on the face of this order has been hcl inspected. O accepted, O received by 
me and conforms to contract. Items listed below have been rejected for the reasons indicated. 


SHIPMENT | PARTIAL —— DATE RECEIVED SIGNATURE OF AUTHORIZED U.S. GOV'T REP. 
NUMBER 


TOTAL CONTAINERS ra e WEIGHT RECEIVED AT 


REPORT OF REJECTIONS 


QUANTITY 
(TEM NO. SUPPLIES OR SERVICES UNIT REJECTED REASON FOR REJECTION 


OPTIONAL FORM 347 (REV. 6/95) BACK 
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SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS 


ITEM SUPPLIES / SERVICES QTY/UNIT___UNIT PRICE _ EXTENDED PRICE 
0001 VAERS SARS-CoV-2 


The contractor shall provide CDC and 
FDA technical and programmatic support 
to collect and analyze information on 
vaccine adverse events (VAEs), and 
facilitate reporting to VAERS specifically 
pertaining to SARS-CoV-2. Reference the 
SOW and all associated deliverabies. 


This is a T&M, severable line item. 
PoP: 08/27/2020 — 08/26/2022 


Line(s) Of Accounting: 

9390BSX 2512 2020 75-75-X-0512-0 
2004111101 

9390FG5 2512 2020 75-2024-0943 
325111101 


0002 TraveVODCs 


All travel must be in accordance with the 
Federal Travel Regulations (FTR). The 
Contractor shall obtain COR pre-approval 
of estimated travel expenses prior to 
travel occurrence. Charges will be 
submitted for actual costs incurred. The 
contractor shall ensure that the requested 
travel costs will not exceed the amount 
authorized in this task order. 


Other direct costs include travel and 
training requirements. All other direct 
costs must be pre-approved by the COR 
prior to occurrence. 


T&M, severable line item 
PoP: 08/27/2020 — 08/26/2022 


Line(s) Of Accounting: 

9390BSX 2512 2020 75-75-X-0512-0 
2004111101 

9390FG5 2512 2020 75-2024-0943 
€325111101 
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0003 Contract Access Fee 
The Contract Access Fee (CAF} is 0.75% 
to be applied to the total price for 
contractor performance as billed to the 
government on each Task Order. The 
CAF is paid by the Ordering Agency, but 
remitted to GSA by the Contractor. Based 
on the established CAF rate, the 
Contractor shall include the CAF in each 
proposal. The Contractor shall include the 
CAF as a separate cost element per year 
on all quotes to the government, 
regardless of contract type. The CAF 
shall never be treated as a negotiable 
element between the Contractor and the 
Ordering Agency. The CAF Rate, 
effective at time of the Task Order award, 
shall remain the same for that Task Order 
for the full term of the Order. 


PoP: 08/27/2020 — 08/26/2022 


Line(s) Of Accounting: 

9390BSX 2512 2020 75-75-X-0512-0 
2004111101 

9390FG5 2412 2020 75-2024-0943 


C325111101 | (4) 


Task Order Total (b)(4) 
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STATEMENT OF WORK FOR 
VACCINE ADVERSE EVENT REPORTING SYSTEM (VAERS) 
FOR SARS-COV-2 VACCINES 


L BACKGROUND: 

The Vaccine Adverse Event Reporting System (VAERS) is a mandated program sponsored jointly by the Centers 
for Disease Control and Prevention (CDC) and the US Food and Drug Administration (FDA). The purpose of this 
project as authorized by the National Childhood Vaccine Injury Act (NCVIA), P.L. 99-660, is to provide a single 
nationwide mechanism to report, analyze and monitor vaccine adverse events (VAEs) that occur after receipt of 
vaccines. It also provides a vehicle for disseminating vaccine safety information to vaccines, family members, health 
care providers, vaccine manufacturers, government agencies, and other partners. 


Vaccines represent one of the most cost-effective means of reducing or eliminating morbidity and mortality from 
selected infectious diseases. However, no vaccine is completely effective or safe. Recommendations for the use of 
vaccines are based on careful weighing of benefits of vaccination and risks of both the disease being vaccinated 
against and the immunization itself. Vaccines currently in routine use have been determined by various expert 
groups and FDA to have benefits that outweigh their risks. As part of any vaccination program, ongoing monitoring 
is essential to ensure that new or rare VAEs are recognized and appropriate measures taken. Vaccines undergo 
safety and efficacy testing in the laboratory and in controlled clinical studies before licensure or authorization (in the 
case of Emergency Use Authorization). Because these trials are limited in size, duration, and heterogeneity, rare, 
delayed, or unusual events caused by a vaccine may not be detected. Once a vaccine is used in the general 
population, post marketing surveillance is necessary to evaluate such VAEs, 


To meet each agency's needs for vaccine safety monitoring data, CDC and FDA have jointly sponsored VAERS 
since 1990. The needs relate to CDC's public health responsibility for developing and issuing national vaccine 
policy recommendations and FDA's responsibility for licensing and regulating vaccines. 


VAERS contains reports of VAEs based on two criteria, mandated and voluntary reports. The events mandated for 
healthcare provider and vaccine manufacturer reporting are listed in the Reportable Adverse Events Table (RET) 
available at https://vaers.hhs.gov/docs/VAERS Table of Reportable Events Following Vaccination.pdf US- 
manufacturers of vaccines are mandated by 21 CFR Part 600.80 (Attachment 3) to submit reports routinely on a 
periodic basis, as weil as in an expedited manner for more serious events. In addition, healthcare providers are 
encouraged to report all other clinically significant VAEs following the administration of any US vaccine in all age 
groups. For all reports, the impetus for reporting is not a presumed causal relationship between the vaccination and 
the event but may be based simply on the occurrence of the event temporally following vaccination and the lack of 
other obvious causes. 


From 2014 through 2018, VAERS received an annual average of 53,000 reports, of which 45,500 were US reports. . 
Of the US reports, 5.0% were classified as serious (i.e., associated with disability, hospitalization, prolongation of 
existing hospitalization, life-threatening illness, congenital anomaly/birth defect, or death [21 CFR 600.80]). Since 
1990, VAERS has received over 740,000 reports, most of which describe mild and self-limited adverse events such 
as injection site reactions and fever. (VAERS government data archive January 18, 2019.) VAERS helps to identify 
important new safety concerns and thereby can help inform vaccine policymakers and healthcare providers. In 
addition, the data are valuable for regulatory actions and vaccine research studies. The US Government considers 
post-licensure/authorization surveillance for any licensed and new vaccines through VAERS to be a nationally 
critical function, and the US Government considers the requirements of the VAERS activity to constitute essential 
services for which any lapse in coverage of services would be unacceptabie. 


The current COVID-19 pandemic and the anticipated COVID-19 vaccination program has created additional 
requirements for VAERS. Unanticipated project needs have materialized, requiring efforts beyond routine VAERS 
functions. Task requirements in support of public health emergencies (e.g., pandemic influenza, natural disasters 
and terrorist activities) and unanticipated federal mandates which are unpredictable necessitate an increase in 
Contractor staffing. These new requirements may result in increased workload for any of the tasks listed in the 
SOW Tasks l-5. The Contractor shall be prepared to address unforeseen events/circumstances and meet the needs 
of the Government as it relates to such events. Reasonable accommodations will be made to the Contractor by the 
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Government to address unforeseen events/circumstances and the Contractor will be allowed to negotiate the 
implementation of changes. 


I. OBJECTIVES: 

The Vaccine Adverse Event Reporting System (VAERS) is the nation’s frontline system for detecting potential 
vaccine safety concerns after vaccines are licensed or authorized for use in the United States. It is a nationwide 
mechanism by which VAEs may be reported, analyzed, and made available to the public. It provides a vehicle for 
disseminating vaccine safety information to vaccines, family members, health care providers, vaccine 
manufacturers, government agencies, and other partners. WAERS is a collaboration between CDC and FDA. 


The purpose of this task order is to provide CDC and FDA technical and programmatic support to collect and 
analyze information on vaccine adverse events (VAEs) after administration of SARS-CoV-2 vaccines and facilitate 
reporting to VAERS. The objectives of the VAERS Project are divided into three categories: programmatic (mainly 
CDC), scientific (CDC and FDA), and regulatory (FDA). 


Programmatic Project Objectives: 
1. Create and maintain an online reporting website for V AEs following receipt of SARS-CoV-2 vaccines 


2. Implement an electronic submission gateway for manufacturers to submit YAE reports on SARS-CoYV- 
2 vaccines 


3. Provide a reporting mechanism for VAEs that maintains submitted SARS-CoV-2 vaccines reports, 
including images of reports and medical documentation; 


4. Ensure data in the VAERS reports are accessible to the public as required by law (P.L. 99-660, Section 
2125), in accordance with policies to protect individuals’ privacy; 


5. Support CDC and FDA scientific staff in using VAERS data on VAEs after SARS-Co¥V-2 vaccines to 
rapidly respond to vaccine safety concerns or public health emergencies and in conducting 
epidemiologic and other scientific studies 


Scientific Project objectives: 
|. Rapidly detect new, unusual, or rare VAEs after SARS-Co¥V-2 vaccines; 


2. Assess the safety of SARS-Co¥V-2 vaccines; or assess the safety in specific populations or situations 
where a new recommendation for SARS-CoV-2 vaccines occur; 


3. Rapidly identify vaccine lots for SARS-Co¥V-2 vaccines with increased numbers or types of reported 
adverse events (FDA lead); and 


4. Monitor trends in known VAEs after SARS-CoV-2 vaccines, particularly increases in reported YVAEs 


Regulatory Project Objectives: 
1. Implement regulatory requirements related to VAERS, especially regarding reports from 


manufacturers after SARS-Co¥-2 vaccines. [21 CFR 600.80]. 


Ill. SCOPE OF WORK: 
The contractor shall provide support and technical assistance to CDC and FDA by supporting work in the following 
areas. The tasks below are not in order of priority. These tasks include: 


Administrative 

Report Receipt/Processing 

VAERS Follow Up Activities and Enhanced Surveillance 
Quality Control for VAERS Data 

Information Management 


we who 
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Current VAERS plans, protocols, procedures, manuals, standard operating procedures (SOPs), software, some 
hardware, etc. may be provided by the Government for adoption/modification (i.e., the contractor would not have to 
develop all entirely new products, but would have the option of rolling over/adopting/modifying existing ones). 
Additionally, scanning reports for the image database, certain manual data entry tasks, and other processes clearly 
related to paper reports shall only apply to paper reports (1.e., electronic reports do not require scanning and manual 
data entry, but may require redaction). 


TV. DESCRIPTION OF WORK: 

The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (VAE) reports 
after SARS-Co¥-2 vaccines. The total number of reports received during periods of peak activity (which are not 
expected to reflect sustained activity) is expected to be 1,000 reports per day, with up to 40% of the reports serious 
in nature. 


TASK 1. ADMINISTRATIVE 
STANDARDIZED METHODS FOR PROVIDING OPERATIONAL SUPPORT FOR THE VAERS PROGRAM. 


A. The Contractor shall maintain Capability Maturity Model (CMM) Level 3 certification (or equivalent) or 
higher throughout the performance period of the contract and shall provide the Government current 
documentation of its CMM Level 3 (or equivalent) or higher certification. 


B. The Contractor shall have staff available for program operations, systems maintenance and consultation 
during normal business hours (8:30 AM Eastern to 5:00 PM Pacific) to accommodate all four time zones 
within the continental United States. The rationale for this requirement is that it is essential for VAERS to 
be fully operational and for staff to be available to conduct systems maintenance and recovery during both 
east and west coast business hours and to also provide a reasonable level of service for the Hawaii-Aleutian 
time zone, since VAERS is a national spontaneous surveillance system. 


C. The Contractor shall maintain a disaster recovery site for data management, data storage and all other 
VAERS data and IT functions that duplicates and replicates the primary production site and provides 
recovery of the production site within 24 hours (refer to Task 5: INFORMATION MANAGEMENT for 
capability requirements). This site shall be at least 100 miles away from the primary production site. The 
rationale for this requirement is that the disaster recovery site must be sufficiently distanced from the 
immediate area of the primary production site, but realistically within a business day’s drive during an 
emergency. 


D. The Contractor shall provide hardware, software, office and communications equipment and other 
resources to be used for data receipt, processing, editing, analysis, reporting, transmission, and storage. 
The Contractor shali ensure systems compatibility with CDC and FDA software and hardware 
requirements. The Contractor shall ensure that applicable technology is capable of upgrade or provide for 
replacement with later technology if necessary. Hardware, software and equipment shali be maintained and 
upgraded in accordance with industry standards for IT and telecommunications equipment including 
routine maintenance, 


E. The Contractor shall upgrade VAERS program and related applications at the Government’s direction 
through official modification signed by the Contracting Officer (CO), based on requirements gathered from 
Government and other program stakeholders, using structured, phased software development methodology. 


F. The Contractor shall provide the Government with current and detailed system documentation, 
Documentation shall be maintained in two separate volumes: “Volume 1 — VAERS Business Processes” 
and “Volume 2 — VAERS IT Requirements and Design”. Requirements shall be maintained in a formal 
requirements database, to be prioritized by a change control board consisting of CDC, FDA and Contractor 
personnel. Work will be prioritized using this process, in both a routine and expedited manner as 
appropriate. The Contractor must demonstrate adherence to formal CMM Level 3 methodology as the 
standard for project performance. System documentation will be presented in standardized text format, 
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generated in Microsoft Word document format (or other word processing format as specified by the 
Government), with all diagrams and other graphics contained as embedded objects with no external files or 
links, and presented in legible paper form or electronic form if requested by the Government. The 
Contractor shall provide detailed documentation of the technical procedures for data transport to the CDC 
and FDA, and documentation of technical details for source code and code relation, library dependencies, 
and data transport mechanisms. The Contractor shall provide the Government with this documentation 
within 30 days after contract award and annualiy or as requested thereafter, and new sections or 
documentation revisions will be provided to the Government upon implementation of changes in the 
system or procedures. 


The contractor shall communicate with CDC and FDA, any requested changes to the system (including, but 
not limited to database structure, and data processes) prior to implementation. Modifications/changes will 
not be performed until approval from CDC and FDA. 


The Contractor shall write standard operating procedures (SOPs) and modify them as needed. SOPs for all 
aspects of VAERS program operations, including complete VAERS report processing, shail be updated and 
provided to the Government annually or as requested. All SOPs shall be submitted to the Government for 
initial review and approval within 30 days after contract award and within 30 days of revision or 
implementation of changes, and minimally on an annual basis or as requested by the Government 
thereafter. SOPs shall be provided in a volume or series of volumes organized by subject, and will be 
presented in standardized text format, generated in Microsoft Word document format (or other word 
processing format as specified by the Government), with all diagrams and other graphics contained as 
embedded objects with no external files or links. 


The Contractor shall provide VAERS operations and system orientation for Government employees as 
necessary (minimum once per year). 


The Contractor shall produce and distribute the VAERS reporting form {Attachment A) and other forms as 
required for the operation of the VAERS program and reporting to VAERS. The VAERS program shall be 
identified as a Government program and the corporate name of the Contractor shall not be used on any 
form or correspondence to any entity other than CDC, FDA, or VICP, or used in any communication to 
represent the VAERS program unless approved by the Government. 


The Contractor shall maintain lists of names, phone numbers, fax numbers, and 

E-mail addresses of contact personnel responsible for reporting from state health agencies, vaccine 
manufacturers, and immunization programs, limiting access and use to VAERS purposes only. The 
Contractor shall update this list on a quarterly basis and maintain this list for access by the Government in a 
manner specified by the Government. 


The contractor shall shred ail incoming documents once they are permanently saved electronically. 


. The Contractor shali establish, implement and maintain selected work groups as 


required by the Government throughout the life cycle of the contract, as needed and directed by the 
Government, and shali take and distribute minutes for working group meetings at the direction of the 
Government. 


TRANSITION OF CONTRACT SERVICES 
The Government considers VAERS an essential service; any lapse in coverage is considered unacceptable and can 
result in possible termination of contract. The Government requires a smooth and orderly transition of services. 


A. 


No later than 60 days after the contract award the Contractor shall have established a system of operations 
as described elsewhere in this SOW and perform a functional evaluation of the system. Furthermore, the 
Contractor shall be able to receive VAERS reports after SARS-CoV-2 vaccines via any of the means 
specified in this contract (including electronically submitted reports from manufactures (eVAERS) and 
public (website). The Contractor shall also be able to perform all activities involving the handling and 
processing of reports submitted to VAERS including report receipt, processing, data entry, coding, quality 
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control, and report follow-up and verification. Contractor shall be able to provide data to the Government 
in the manners specified within this SOW, including the proviston of data extracts, reports and report 
images, and meet this timeline development requirement as indicated for other activities and functions 
descrihed within this SOW. 


B. No later than 60 days after contract award the VAERS system maintained by the Contractor shall he fully 
operational and shall meet the satisfaction of the Government as to operational functionality. 


C. No later than 60 days after contract award the Contractor shall meet all developmental and operational 
requirements in this SOW unless other specific timeline requirements for those requirements have been 
specified in the SOW. 


D. No later than 60 days after contract award, the Contractor shall provide a Transition-Out Plan (end of 
performance period). The pian shali include a technical and management transition approach that is clear 
and complete and include a timeline and list of resources required for the transition. The Transition-Out 
Plan shall detail the planned transition methodology in logical sequence to ensure a smooth transition of all 
tasks and subtasks without interruption or decline in service quality. The pian shall also include a detailed 
description of risks (cost, technical, and performance) to both the Contractor and the Government, as well 
as risk mitigation strategies. Contractors shall also include ail transition costs within their proposals. Please 
note that the continuity of services clause 52.237-3 is applicable and should be considered in developing 
the transition plan. 


All documents and materials developed by the Contractor for the fulfillment of this contract, including ali SOPs, 
manuals, security plans, management plans and plans of operations, and hardware shail be considered the property 
of the Government and may be disposed of by the Government in any manner at the Government’s discretion. 


CHANGES TO INFORMATION MANAGEMENT PROCEDURES AND TASKS 


A. All tasks and activities specified in this SOW that pertain Information Management are subject to change, 
at the Government’s discretion, to accommodate and support fully electronic reporting to VAERS. 


B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated Information Management procedures and the Contractor 
will be allowed to negotiate implementation of changes within the scope via official modification. 


UNFORESEEN EVENTS/CIRCUMSTANCES 

Unanticipated project needs may materialize, requiring efforts beyond those described in this SOW. The 
Government may modify the contract to add task requirements (or enhance/expand current requirements) in support 
of public health emergencies (e.g. pandemic flu, natural disasters and terrorist activities) and unknown Federal 
mandates which are unpredictable and can initiate a workload surge, necessitating an increase in Contractor staffing. 
These new requirements may result in increased workload for any of the tasks listed in the SOW Tasks 1-5. 


A. Approval Process for Unforeseen Events and Circumstances 
CDC will provide the new work requirements and deliverables for each of the optional support services to 
the Contracting Officer (CO) as a revision to the SOW. The CO will send the contractor the revised SOW 
containing the new requirements. The contractor will review the requirements and provide a technical and 
cost proposal with the appropriate labor categories, number of hours, and labor rates to the CO. A contract 
modification (SF30) must be awarded by the CO to add any new optional support requirement. The 
contractor must not work outside of the SOW without authorization from the CO. 


B. The Contractor shall be prepared to address unforeseen events/circumstances and meet the needs of the 
Government as it relates to any unforeseen events/circumstances, Reasonable accommodations will be 
made to the Contractor hy the Government to address unforeseen events/circumstances and the Contractor 
will be allowed to uegotiate the implementation of changes. 
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C. The implementation of activities to address unforeseen events/circumstances specified by the Government 
is dependent on the availability of core and suppleinental funding to support such activities. 


D. Examples of unforeseen events/circumstances that have impacted VAERS operations include (1) changes 
in the IT certification and accreditation process, (2) changes in regulatory requirements for reporting VAEs 
and transmitting data to CDC and FDA, (3) introduction of new vaccines resulting in necessary coding and 
database architecture changes, (4) changes in reporting requirements, report processing procedures, and 
data availability timelines to meet current public health needs, (5) urgently needed IT capability during 
public health emergencies or in preparation for anticipated public health emergencies, and (6) hardware and 
software upgrades to accommodate unforeseen events/circumstances. This is not an exhaustive list and 
other unforeseen events/circumstances may occur throughout the course of the contract performance 
period. 


PROGRAM MANAGEMENT PLAN FOR CONTRACT ACTIVITIES 


A. The Contractor shall develop and maintain a Program Management Plan (PMP). The Contractor shail 
prepare and maintain a phased Program Management Plan describing the tasks, milestones, risk 
management strategy, organizational resources, performance measures and management control to be 
employed to meet the cost, performance requirements and schedule of each phase of the VAERS project. 
The plan shall define the Contractor’s govemance process and include: 


1. The management structnre of the Prograin Management Team, organizational charts, key personnel 
and main points of contact, and identification of project teams and their roles and responsibilities. 


2. Identification of all partners, sub-contracts, sub-contractor management, criteria for selection of sub- 
contractors, and description of services to be performed by sub-contractors. The Contractor shail not 
sub-contract ont more than 25% of the work described in this SOW (i.e., 75% of the work 
requirements described in this SOW must be completed by the prime Contractor). Sub-contracting out 
clinical services tasks, report processing and data entry, coding, report follow-up activities, core IT 
activities, quality assurance, and core business and administrative tasks is strongly discouraged and 
will be viewed unfavorably and result in possible termination of contract. 


3. Detailed mitigation response procedures in the event of unsatisfactory performance of program/project 
team members or sub-contractors. 


4. Specification of strategies to include detailed timelines with critical milestones to ensure that both 
iong-term, strategic goals as well as specific, targeted objectives are met efficiently and effectively. 


5. The Contractor shall submit the PMP to the Government within 30 days after contract award and shail 
provide updates to the PMP annually or as requested by the Government. The PMP shall be in 
accordance with OMB Circular A-11, and the Federal IT Capital Programming Guide, Supplement to 
Part 7 of Circular No. A-11. Approval of the PMP by the Government shall be required. 


B. Key Project Personnel: The Contractor shall employ and retain competent, qualified personnel to perform 
services of this contract in an effective, prompt, accurate, courteous and efficient manner. The Contractor 
shall provide a plan for staffing key positions for this project, providing detail about the criteria and 
selection process used to fulfill the requirements of this contract, and shall notify CDC in the event of 
changes in staffing of key positions. Staffing of these key positions shall be subject to Government 
approval. The Contractor shali provide all necessary supervisory, project management, managerial, clinical, 
technical and administrative support to meet the planning, implementation, operational and management 
requirements of this contract. 


**NOTE FOR ALL TASKS 
Qualifications for personnel performing clinical activity (clinical staff) shall be subject to approval by the 
Government; the minima! education and experience qualifications for this activity shall be a nurse or other 
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clinical heaithcare provider, with a minimum of 2 years of clinical or public health related experience. The 
manager of the follow-up activity shall be, at a minimum, an RN, PA, MD, DO or equivalent (e.g., MD 
from a foreign country who is not licensed to practice in the United States), The manager is required to 
have at least 2 years of clinical experience. The manager shall work closely with the Government to ensure 
that follow-up is conducted according to Government expectations. 


REPORTING REQUIRMENTS: 


A. PROGRAM MANAGEMENT MONTHLY STATUS REPORT - The contractor shall provide the 
Government with a monthly Program Management Monthly Status Report electronically to include the 
project’s cost, progress, and issues in a format as directed by the Government. A copy of each monthly 
report shall be sent to the COR, the CO, and the FDA Technical Representative. The contractor shall 
document in the report the efforts performed in the completion of each project task. The report shall be due 
on the 15th day of each month following the month reported upon. 


The Contractor shall propose format and data element recommendations for this report. The final format of 
the report shail be determined upon contract award. 


B. ANNUAL REPORT - On an annual basis, the Contractor shall provide a written report to the Government 
documenting significant work activities and accomplishments for the preceding 12-month period. This 
report shall provide a historical record of major work activities accomplished, those ongoing and those not 
accomplished for the reporting period. As an appendix to the annual report, the Contractor shall deliver to 
the Government the current database dictionaries, standard operating procedures, and user manuals. The 
annual report shall be delivered to the Government no later than 30 days following the specified reporting 
period. One report shall be sent to the COR, the CO, and the FDA Technical Representative. 


G: DRAFT FINAL REPORT - The Contractor shall provide a draft final contract report no later than 
45 days prior to the expiration date of year 2 of this contract for review by the Government. The report 
shall include a written narrative highlighting major accomplishments under the contract. The report shall 
address each year of performance under the contract and document significant contractor findings, 
conclusions, recommendations, ete., to provide an objective review of contract activities. The Contractor 
shall provide copies of each draft final report electronically, and optional paper copies at the Government’s 
request. One report shall be sent to the COR, the CO, and the FDA Technical Representative. 


D. FINAL REPORT - Following review of the draft final report by the Government and receipt by the 
Contractor of the Gevernment’s written comments, the contractor shall provide a final report on or before 
the expiration date of the contract. The Contractor shall provide copies of each final report electronically, 
and optional paper copies at the Government’s request. The report shall be sent to the COR, the CO, and 
the FDA Technical Representative. 


FORMAT OF DELIVERABLES 

Specific form format and additional content requirements of the delivery schedule items shall be coordinated 
between the Contractor and the Government, with a continued focus on providing useful and accurate reporting. 
The COR will provide the Contractor with disposal instructions for all technical documents (including. but not 
limited to all database dictionaries, databases, software, computer code, documentation, questionnaires, electronic 
files, etc.) in possession of the contractor at contract completion. 


TASK 2. REPORT RECEIPT/PROCESSING 


REPORTING TO THE VACCINE ADVERSE EVENT REPORTING SYSTEM (VAERS) AFTER SARS-CoV-2 
VACCINES 
The Contractor shall perform the following tasks/activities: 


A. Maintain communication protocols to provide assistance to the public for Vaccine Adverse Event 
Reporting System (VAERS) after SARS-Co¥-2 vaccine-related questions. Communication protocols shail 


E 
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involve appropriate telecommunication and electronic mechanisms for answering questions related to 
VAERS SARS-CoV-2 vaccine reporting and the VAERS system (e.g., how to obtain reporting forms, 
options for reporting, information referrals), and aliowing for filing of VAERS reports over the phone in 
English or Spanish. The Contractor shall maintain communication protocols including, but not limited to: a 
toll-free telephone number and toll-free telefacsimile number to be listed as VAERS; a web site identified 
as VAERS, and an e-mail address (e-mail address may be specified by Govemment). The Contractor shall 
have staff available for consultation during normal business hours (8:30 AM to 5:00 PM) that 
accommodate all four time zones within the continental United States (refer to Task 1: 
ADMINISTRATIVE for options for active time zone coverage during normal business hours in the 
continental United States). The Contractor shall implement, maintain, and upgrade as necessary, 
telecommunication and electronic reporting systems to be available 24 hours-per-day (the toll-free 
telephone number is answered by machine after busiuess hours). After-hours automated support shall be 
available 24 hours-per-day through the web and fax. See Emergency Preparedness section for after-hours 
support details. Contractor staff shall respond to messages received at the VAERS telephone number and 
messages sent to the VAERS e-mail address within one business day of receipt. 


Staff the telephone system to provide telephone support for reporting during hours that accommodate 
normal business hours in the four time zones in the continental United States. The Contractor shall maintain 
a telephone voice message system, available at all times, which shall: 


1. Provide a mechanism for callers to contact VAERS toll-free by telephone; 


2. Provide coverage by automated menu choices for those times when Contractor staff does not 
immediately respond to calls to the telephone system, 


3. Provide instructions to callers on ways to obtain the VAERS form and instructions on how to submit a 
VAERS report; 


4. Provide directions to find the VAERS website and to submit a VAERS report using the internet-based 
reporting form, 


5. Take messages at those times the telephone system is not actively staffed; 


6. Provide information on the National Vaccine Injury Compensation Program (VICP) (website 
information: www.hrsa.gov/vaccinecompensation); 


7. Provide additional information to callers as directed by the Government. 


Maintain a United States Postal Service post office box identified as Vaccine Adverse Event Reporting 
System (VAERS) for SARS-CoV-2 vaccines and ensure, at a minimum, retrieval and logging of all mail 
from the post office box during each business day. 


Maintain VAERS for SARS-CoV-2 vaccine electronic internet-based reporting system, utilizing 
appropriate system security precautions. This includes reports submitted by VAERS users such as state 
health coordinators, immunization programs, other Federal Government agencies and programs, and other 
parties. The procedures shall include methods for receipt of reports via the Internet and shall allow for 
reporters to submit an initial VAERS report for SARS-CoV-2 vaccines or a non-priinary report using an 
Internet-based application, including an electronic version of the VAERS forin for SARS-CoV-2 vaccines. 


Maintain procedures to migrate data from VAERS SARS-Co¥-2 vaccine manufacturer reports received 
electronically into the database, utilizing appropriate system security precautions. Manufacturer reports 
that must be received electronically include -marketing expedited individual case safety reports (ICSRs), 
periodic ICSRs, as well as malfunction reports and 5-day reports required by the Combination product 
Post-market Safety Reporting Rule. Electronic manufacturer reporting using ICH E2B (R3) is referred to 
as eVAERS. 
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F. AJl methods for electronic transmission of reports developed and maintained for this project shall be based 
upon the HL7/ISO 27953-2 specification available at: 
http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=53825, the ICH 
E2B(R3) Implementation Guide available at: http://www.ich.org/products/electronic-standards.html, the 
FDA E2B(R3) Implementation Technical Specification that will be available on CBER’s ICSR website at: 
https://www.fda.gov/industry/about-esg/cber-vaccine-icsr-implementation , or other formats as specified by 
the Government. 


G. Develop, document and implement procedures for the entry and processing of SARS-Co¥V-2 vaccine report 
data to ensure that the VAERS public data that is made available to the public is redacted of all protected 
health information (PHI) and other information that 1s protected under the Health Insurance Portability and 
Accountability Act (HIPAA) (http://www.hhs.gov/ocr/privacy/), or otherwise not publicly releasable for 
reasons of commercial confidentiality (as directed by the Government), regardless of the report source 
(paper/fax/other, web, e-report). Government users of VAERS SARS-CoY-2 vaccine data shall have 
access to personal identifiers from the specific fields for names, addresses, telephone numbers, etc. through 
the internet-based report viewing system created and maintained by the Contractor. Such data containing 
PHI shall be included at the direction of the Government in the Government Extract for the CDC, FDA or 
both. 


H. Maintain a methodology to permanently archive electronically submitted VAERS SARS-Co¥-2 vaccine 
reports as originally submitted, prior to any editing or redaction. The method shall allow for identification 
and retrieval of the reports from the archive database by specific report identifiers and by organization 
source of origin for reports submitted by manufacturers, state health coordinators, immunization prograins, 
other Federal Government agencies and programs, and other parties. 


L Maintain methods to support a variety of Electronic Data Interchange (EDI) message types specified by the 
Government. The Contractor shall have the capability to both receive and transmit VAERS SARS-CoV-2 
vaccine reports electronically in EDI formats specified by the Government and in additional electronic 
report submission formats consistent with electronic submission requirements based upon the HL7/ISO 
27953-2 specification available at: 
http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=53825, the ICH 
E2B(R3) Implementation Guide available at: http://www.ich.org/products/electronic-standards.html, the 
FDA E2B(R3) Implementation Technical Specification that will be available on CBER’s ICSR website at: 
https://www.fda.gov/industry/about-esg/cber-vaccine-icsr-implementation, and other formats specified by 


the Government. 


J. Under the direction and approval of the Government, the Contractor shall support additional EDI interface 
products for VAERS users. These include products from other vendors that use the VAERS web-reporting 
form, commercial off-the-shelf products, and other products as they are developed. An EDI interface 
product has been developed, utilizing the VAERS internet-based electronic submission form as a means for 
EDI electronic submission of VAEs by VAERS users from their immunizations databases. The Contractor 
shall successfully complete this task for existing, supported EDI interface products within 30 days after 
contract award. The contractor shall successfully complete this task for new EDI interface products of this 
nature within 30 days following direction from Government to perform this task. 


STANDARDIZED METHODS FOR ENTERING AND PROCESSING VAERS SARS-CoV-2 VACCINE REPORTS 
A. Report Data Entry and Processing Timeline Requirements: 


The Contractor shall perform all necessary data entry for information submitted on VAERS forms for 
SARS-CoV-2 vaccine reports and related documents, and editing of the database, with all entry and edits 
tracked by date and entry staff and editors’ individual identification. The Contractor shall be able to 
perform these activities within 30 days after contract award, See Appendix A (also in the section under 
Task 3) for information on scanning, data entry and coding timelines. 
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The timeline requirements for processing reports for VAEs of special interest to the Government (e.g., seizure} may 
differ from the above requirements and will be determined or otherwise agreed upon in SOPs approved by the 
Government. Timelines will be adjusted in response to changing public health needs, such as during a public health 
emergency or if a vaccine recommendation changes (e.g., a vaccine that was not previously recommended for 
children becomes recommended}. 


B. 


Documentation, SOPs, and user procedure manuals: 


The Contractor shall perform the following tasks/activities related to adverse events reported after SARS- 
CoV-2 vaccines: 


1. Maintain and update comprehensive documentation of database structure; design and analysis, 
including dictionaries, edits, report processing, and computer programs (including menu driven 
programs); user procedure manuals; and other tasks and functions and any modifications set forth in 
this SOW. Documentation shall adhere to the standards set forth elsewhere within this statement of 
work, to include Capability Maturity Model (CMM) standards. 


ta 


Provide user-procedure manual(s) and SOP manuals for technical aspects of VAERS SARS-CoV-2 
vaccine database operations to the Government within 30 days after contract award. Implementation 
of ail procedures is contingent on Government review and approval. 


3. Maintain, update and provide to the Government as requested complete documentation of the SARS- 
Co¥V-2 vaccines database and ali regularly produced extracts. The documentation shail be readily 
available to the Government for use or reference and include data dictionaries for the datasets 
(including variable names, formats, descriptions, comprehensive list of legal codes) versions of the 
Medical Dictionary for Regulatory Activities (MedDRA) terms, (www.medramsso.com) or other 
coding language chosen by the Government, and look-up tables for vaccine, manufacturer, and 
MedDRA terms. 


4. Maintain full, detailed documentation for all business and technical aspects of the VAERS SARS- 
CoV-2 vaccine program. Documentation shall be updated annually or as requested by the 
Government, and maintained in two separate volumes: “Volume | - VAERS Business Processes” and 
“Volume 2 — VAERS IT Requirements and Design” as detailed in the Administrative section of this 
SOW. 


5. Maintain a formal “requirements” database, to be prioritized by a “change request board” consisting of 
CDC, FDA and Contractor personnel. Work shall be prioritized by this process, in both a routine and 
expedited manner as appropriate to the requirement. 


ACKNOWLEDGMENT, VERIFICATION, CODING AND DATA COLLECTION FOR ADVERSE EVENTS 


REPORTED AFTER SARS-CoV-2 VACCINES 
The Contractor shal! perform the following tasks/activities: 


A. Review all documents received daily through all channels to prioritize processing, and assign a unique 


index number to each report received and initiate processing based on SOPS for the report category and 
method of transmission. The unique index number (VAERS ID number) shall appear in the personal data 
files and in files created for other information. 


For electronically submitted reports and reports submitted using the internet-based reporting application, a 
unique index Electronic Report Number (ERN) shall be generated at the time the report is received, and 
shall be communicated back to the originator of the report using a formal acknowledgement or EDI 
submission confirmation message integrating the E-Report Number into the message. The ERN shall be 
included in the primary system database and in the Government extract, and in relational data tables 
providing linkage between the ERN and VAERS ID number assigned to each report and may be used to 
query the VAERS report in the master database and Government extract. For electronically submitted EDI 


G. 
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reports, sufficient information shall be retained from the EDI VAE message to uniquely identify the report 
and enable tracking and identification of the report within the primary system database, 


Enter into the database al] data submitted on report forms and related documents within the time limits 
specified in this SOW. 


Code VAE data after SARS-Co¥V-2 vaccines on the VAERS report form (paper or electronic form/data), 
from related documents/records, and from additional information sources related to the report (i.e., records 
obtained during follow-up) using the most updated version of MedDRA (http://www.meddra.org/) or other 
coding source specified by the Government. Codes shall be entered into the database. Relational tables 
aud data dictionaries shall be provided to the Governmeut for all coding used throughout the system. The 
Government reserves the right to update and replace coding standards as required for the data elements, and 
reserves the right to introduce requirements for standardized coding for data elements not included in this 
SOW. 


1. The Contractor shall enter into the database SARS-CoY-2 vaccine VAE descriptive clinical 
information and other symptoms, signs, lab data and/or disease entities, including text fields contained 
in Boxes 9, 10 11, 12, 18, and 19 on the VAERS reporting form (Available at 
https://vaers.hhs.gov/uploadFile/index.jsp) and code this information using MedDRA (or other coding 
language chosen by the Government). The specific boxes may change if the VAERS form is modified. 


bo 


At the direction of the Government, the Contractor shall assess and potentially implement alternative 
methods for coding reports (computer assisted, automated, algorithm generated, etc.), and conduct 
post-implementation quality assurance. The implementation of alternative coding methods is 
dependent on the availability of core and supplemental funding to support such activities. 


If requested by the Government, in the event that FDA approves new or modified labeling for a SARS- 
CoV-2 vaccine, the Contractor shall identify Y AEs from the Adverse Reaction, Precautions, and 
Contraindications sections of the labeling and translate them into MedDRA (or other coding language 
chosen by the Government) terminology (known as labeled event data). When there is a change in 
labeling, the Contractor shall submit proposed modifications to the Government and modify the list of 
terms at the direction of the Government. All code lists or labeling changes submitted by the SARS-CoV-2 
vaccine manufacturers must be approved by the Government before implementation. 


At the direction of the Government, the Contractor shall develop, update, maintain, and provide data 
dictionaries for all data tables provided to the Government including the tables associated with vaccines, 
adverse event coding (MedDRA, or other coding language chosen by the Government), manufacturers, and 
labeled events associated w/vaccines. The labeled event dataset shall indicate labeled events associated 
with SARS-CoV -2 vaccines as identified in vaccine package inserts and product labels. The contractor 
shall enter labeled events within 10 working days following the introduction of a new vaccine or at the 
direction of the Government. The Contractor shall review and update the labeled events table annually or 
as necessary. 


Comply with the safeguarding procedures for report forms as required by the NCVIA — 42 U.S.C. 300aa- 
25, and the safeguarding guidelines of the Privacy Act. The Contractor shall ensure that information which 
could identify an individual (such as name, street address, telephone number and email address of the 
person who received the vaccine and that person's legal representative) shall not be made available to any 
person other than the person who received the vaccine or the legal representative of such person and duly 
authorized staff of CDC, FDA and other participating federal entities. The restriction on access to 
identifying information applies to all information received by the VAERS activity, regardiess of physical 
format (paper, electronic, other). The process shall be subject to review and approval by the Government. 


Maintain storage of original and depersonalized data separately. Records shall be maintained in accordance 
with Privacy Act regulations and procedures and defined in the Automated Information Systems Security 
Program Handbook. Separate physical and electronic storage of original and redacted report data shail be 
maintained. 
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DATA AND DOCUMENT ACCESS, TRANSMISSION, STORAGE AND RETRIEVAL 
(See Appendix A for detailed information on scanning, data entry and coding timelines). 
The Contractor shall perform the following tasks/functions: 


A. Maintain procedures to complete processing of death, 5-day, 15-day, serious, or other priority reports as 
specified in Appendix A, or upon request of the Government. 


B. Make available to the Government an electronic copy of all received documents within the specified 
timeframes detailed in Appendix A. The Contractor system (currently a virtual private network [VPN] 
containing scanned images) enables Government staff electronic access to reports/documents while 
preserving the integrity of the original document. 


C. Scanned reports and other documents that the Contractor makes available to the Government on the VPN 
do not require redaction unless specified by the Government. 


D. Provide a data extract (Government Extract) of the VAERS SARS-Co¥-2 vaccine data to the Government 
for storage and use at Government sites (both CDC and FDA) each business day, in accordance with this 
SOW. 


E. Redact all PHI from reports to the VAERS database after SARS-Co¥V-2 vaccines that appear anywhere on 
the VAERS report form except boxes specifically asking for PHI. For example, if Box 18 on the VAERS 
2.0 form states “I gave Mr. Jones his flu shot and then he had a reaction,” the words “Mr. Jones” should be 
redacted from the VAERS database. 


CHANGES TO REPORT RECIEPT AND PROCESSING 


A. All tasks and activities specified in this SOW that pertain VAERS report receipt and processing are subject 
to change, at the Gnvernment’s discretion. 


B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated report receipt and processing procedures and the 
Contractor will be allowed to negotiate implementation of changes. 


TASK 3: VAERS FOLLOW-UP ACTIVITIES AND ENHANCED SURVEILLANCE 
The Contractor shall conduct follow-up on VAERS SARS-Co¥-2 vaccine reports as specified by the Government in 
this SOW. Follow-up consists of the 3 parts outlined below: 

e Communication Activities and Automated Record Collection 

e Record Collection and Data Clarification 

+ Clinical Activities 


COMMUNICATION ACTIVITIES AND AUTOMATED RECORD COLLECTION FOR VAERS SARS-CoV-2 
VACCINE REPORTS 
The Contractor shall: 


A. Upon receipt of a death report from a family member, provide a condolence letter to express sympathy and 
explain VAERS procedures. 


B. Provide immediate electronic acknowledgement to all persons who submitted VAERS reports via the 
Internet using the online reporting tool. 


C. Provide acknowledgement in the form of a thank-you notification to all persons who submitted Y AERS 
reports via paper format. Exceptions to this requirement are family members who report deaths, all 
manufacturers, and all state health coordinator reporters. 
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D. Develop and implement standardized letters, forms, logs, phone scripts and other documents, subject to 
approval by the Government, and implement documents developed by the Government at the direction of 
the Government, in order to verify the accuracy of submitted data. 


E. Maintain procednres to request additional information from reporters or providers if information from 
essential items (2-6, 17, 18, and 21) on the initial VAERS report are missing. inconsistent or invalid. (See 


is altered or updated by the Government. 
F. Maintain procednres to request disposition updates from reporters at 60 days and 1 year after report receipt 
for all serious reports with recovery status listed as not recovered. Include a request for any additional 


information. No 60-day update is required if routine follow-up has been conducted on the report. 


RECORD COLLECTION AND DATA CLARIFICATION FOR SARS-CoV-2 VACCINE REPORTS 


A. For all SARS-CoV-2 vaccine reports designated as serious by regulatory definition (death, life-threatening 
illness, hospitalization, prolongation of existing hospital stay, permanent disability, or congenital 
anomaly/birth defect), the Contractor shall attempt to collect follow-up records and additional 
documentation of the event {includes clarification of the event if necessary}. In addition, for other adverse 
events of importance as determined by the Government, the Contractor shall attempt to collect follow-up 
records and additional documentation of the event. Follow-up activities include: 


L. Identification and resolution of conflicting or incorrect information in the YAERS database and 
annotation in the VAERS graphic image Tile. 


2. Retrieval of pertinent medical records including hospital discharge summary, labs, history and physical 
reports, inedical, death certificates and/or autopsy reports. In addition, if the vaccination information 1s 
missing or nnclear {e.g., a report states “flu vaccine” but the brand or manufacturer name is missing) 
the vaccination record shall be obtained. 


3. Seanning of all collected documents/records into the VAERS image base. 
4. Other follow-up activities as directed by the Government. 


Upon award of the contract, the Government will provide detailed, standard procedures for follow-up, which are 
subject to change based on the needs of the Government. See Appendix A for required timeframes for follow-up. 
VAERS correspondence can be via email or hardcopy letters. 


Report Confirmation for SARS-CoV-2 Vaccine Reports 

Confirmation correspondence is sent on receipt of a VAERS SARS-CoV-2 vaccine report submitted by a consumer 
or healthcare professional. Hardcopy letters or email correspondence are sent, depending on the person’s 
communications preferences (specified in the VAERS report). Vaccine manufacturers do not receive these 
communications. 


REPORT TYPE FOLLOW-UP CORRESPONDENCE TYPE 
STANDARD - NO MISSING Send letter or email Confirmation* 
INFORMATION 
STANDARD -INFORMATION Send letter or email Confirmation with request for missing 
MISSING information* 
SERIOUS WITH “NO” FOR Send letter or email 60 day follow-up and one year follow- 
RECOVERY STATUS up* 
DEATH REPORTS FROM Send letter only Condolence letter; consumers only* 
FAMILY MEMBERS 
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*The Government will provide the format and wording of the letters for the contractor's use 


Medical Record Requests for SARS-CeV-2 Vaccine Reports 


Requests for medical records are sent in follow-up* to a VAERS SARS-CoV-2 vaccine report. 


REPORT TYPE FOLLOW-UP CORRESPONDENCE TYPE 


SERIOUS-NON FLU VACCINE Send request for medical records | Request for medical records** 
Pre eee eee ee eee a 
SERIOUS FLU VACCINE Send request for medical records | Request for medical records for flu 
RE eensieiergorm iter | ate rep 
NON SERIOUS REPORTS OF Send request for medical records | Request for medical records** 
Sarman [mer Pn 


DEATH Send request for death certificate | Request for death certificate** 
letter 


FOREIGN a | 


MANUFACTURER REPORTS None except death or if requested 
by the Government (of special 
interest). 


CLINICAL TRIALS C 


*The Government will provide a guidance document to specify what records the contractor needs to obtain. 
**The Government will provide the format and wording of the letters for the contractor's use 


CLINICAL ACTIVITIES FOR SARS-CoV-2 VACCINE REPORTS 


A. Clinical staff shall review follow-up records and add a narrative summary to the Government data for each 
report to reflect follow-up records collected. If records are not available, clinical staff may need to contact 
providers or patients to obtain follow-up information. For example, if a patient reports a serious adverse 
event but does not seek medical care, the patient or parent would need to be called to obtain the details and 
outcome of the event. 


B. Clinical staff shall add appropriate MedDRA codes to the record to reflect data from the follow-up. An 
indicator variable will be provided to distinguish between initial and follow-up MedDRA codes, as well as, 
item number on the VAERS form. 


C. Clinical staff shall edit or supplement as needed the relevant VAERS database record based on documents 
collected in follow-up (e.g., if the vaccine records differ from what is on the VAERS report, the vaccine 
information shall be corrected in the VAERS data). 


D. Clinical staff shall complete Government-developed forins for specific reports which are intended to obtain 
supplemental information as directed by the Government. 


E. Clinical staff are expected to pursue any leads that become apparent during the follow-up process and obtain 
information beyond what is detailed on any standard questionnaire that may contribute to an understanding 
of the underlying cause(s) of the adverse event in question. The information obtained from these leads shail 
be documented in narrative format by the follow-up staff. For example, if during follow-up the clinician 
learns that the patient had to be readmitted to the hospital, those records should be obtained and summarized 
in addition to the initial hospital admission records. 


F. Information obtained during follow-up shall be clearly separated from information in the VAERS report 
when entering follow-up data into the VAERS database. The Government will provide instructions on how 
this will be accomplished. Foilow-up information will NOT be included in the VAERS public data. 
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G. When unexpected, significant, or unusnal findings are identified dnring the performance of follow-up 
activities, findings shall be shared with FDA and CDC VAERS staff as determined by the professional 
judgment of the clinical staff. 


H. Clinical staff shall stay current on vaccine recommendations and VAEs. A useful resource is the Advisory 
Committee on Immunization Practices website: https://www.cdc.gov/vaccines/hcp/acip-recs/index.htm| 


I. Provide an indicator variable in the database that will specify if the medical records were collected and the 
type of records obtained. 


TASK 4: QUALITY CONTROL FOR VAERS SARS-CoV-2 VACCINE DATA 

The Contractor shall develop and implement a Quality Assurance Program (QAP). The QAP is applicable to all 
functional areas of this SOW and will allow the Government to verify that contract performance objectives are met, 
the best possible contract performance is being provided, and there is continuous improvement in the quality of 
contract services. The QAP is an important tool for using and monitoring performance indicators and ensuring the 
achievement of desired performance measure outcomes. The QAP shall establish quantitative evaluation strategies 
to ensure that contract performance measurements meet or exceed the highest levels of service. 


The Contractor shall work with the Contracting Officer (CO) and Contracting Officer's Representative (COR) to 
develop standardized tools for assessing contract/project activities and provide consistent evaluation scoring. The 
Contractor shall conduct self-assessment and evaluation quarterly through the QAP and other strategies and 
methodologies to ensure quality performance of contract activities. 


The QAP shall establish quantitative evaluation strategies to ensure compliance to the contract performance 
measurements and meet or exceed the highest levels of service. The plan should specify who within the 
Contractor’s organization has oversight for quality initiatives. The Contractor shall provide this plan to the 
Government within 30 days after contract award. The plan should be updated as necessary (at a minimum annually) 
or as instructed by the Government to ensure that it remains current. 


Quality control procedures shail be developed and implemented, subject to review and approval by the COR, for 
submitted data, entered data, scanned images, follow-up data and coded data. The areas to be addressed shali 
include completeness and accuracy of data, recovery status, follow-up, timelines of report processing for serious 
reports, unexpected occurrences (e.g., pandemic influenza, new recommendations), and completeness and accuracy 
of vaccine lot information on ail VAERS SARS-CoV-2 vaccine reports. 


QUALITY CONTROL AND ASSURANCE FOR ENTERED AND PROCESSED DATA FOR SARS-CoV-2 VACCINE 
REPORTS 


A. The Contractor shall establish, implement, update and maintain standardized methods for confirming the 
quality of processed data through standardized quality control and quality assurance procedures designed to 
reduce or eliminate duplicate entries, data inconsistencies or deficiencies. 


B. Subject to Government approval, the Contractor shall develop, demonstrate, document, and implement 
procedures to maintain data quality at a level adequate to support data analysis. The procedures shall 
include: 


1. Automated editing procedures for data entered by the contractor using the Contractor’s internal data 
entry system, including double-entry verification of entered data for select fields in reports as specified 
by this SOW. 


w 


Automated spelling checks for al] text fields on the forms that undergo data entry by the contractor 
using the Contractor's internal data entry system. Automated spelling check functions shall include 
standard and custom dictionary spell check, including abbreviations and medical terminology. This 
process shall detect and alert the operator to possible spelling errors at the time of data entry, so that 
the operator can immediately implement appropriate corrections. 
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ni 


Incorporation of appropriate field restrictions, legal value checks, and background logic checks in the 
data entry software to ensure that the entered information is logical and appropriate before it is 
accepted. These procedures shall include, but wiil not be limited to, the following edit-checks listed 
below : 


a. Keystroke edit checks to ensure only correct values for the field are accepted. All other values 
cause the system to post an error/warning message. 


b. Within-field checks to ensure that data are valid for that field (e.g., entering numbers in a Name 
field is invalid and shail be flagged in error/warning). In addition, unusual values in fields, for 
example: 1) adverse event onset date before vaccination; 2) interval between vaccination date and 
onset date greater than 10 years, shail be flagged. 


c. Cross-field checks to ensure that information does not conflict with previously entered data (e.g., a 
death date is invalid if it is entered with a value prior to the date of birth or vaccination date/onset 
date prior to date of birth). 


All edit checks procedures shall have the ability to be modified as needed. The data entry system shall 
display warnings or error messages when unusual or incorrect information is entered for new records 
or for existing records which are retrieved and updated. 


4, Automated spelling checks and edit-checks, as deseribed above, used on the web data entry system and 
implemented in a manner that does not impede or significantly increase forn completion time by users. 


5. Development, implementation, utilization, documentation and reporting of internally caiculated 
variables to define the quality of the data records entered. These variables shall be made available to 
the Government and shall be utilized in quality assurance programs and assessments by the Contractor 
and by the Governinent. 


6. Establishment of an edit program that outputs missing and non-plausible data for visual verification 
with the corresponding VAERS form image record. 


7. Establishment and implementation of a mechanism for correcting data errors detected in the previous 
steps. 


8. Review ofall data on a quarterly basis to examine frequencies of categorical fields and the distribution 
qualities of continuous variables for any non-plausible data, and verification of any non-plausible data 
indicated in this step. 


a. Establishment and implementation of a mechanism for data corrections indicated in the above 
review processes. 


The Contractor shali perform double data entry on all US serious SARS-CoV-2 vaccine reports and other 
reports as specified by the Government. The verifieation process shall include data entry into two 
independent data files by different personnel unless otherwise approved by the Government. Report entries 
shall be matched by identification number and discrepancies shall be resolved. Target permissible data 
entry effort rates shall be subject to review and approval by the Government. If the Government identifies 
significant data entry quality coneerns, then the requirement for double-data shall be increased to include 
all reports received until further notice from the Government. 


All data entry procedures shall include real-time automated checks for illogical date relationships, invalid 
vaccine types, unavailable vaccines, invalid vaccine manufacturer combinations, invalid manufacturer or 
lot number, and other invalid data element combinations. Documentation of programming of these edit 

checks shall be submitted to the Government upon request. The data entry process shall be configured so 
initial data entry of records cannot be completed until all flagged data have been accepted as corrected or 


G. 
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moved to a queue for subsequent follow-up within one week. These later stages could include, at the 
discretion of the Government: 


1. Addition of a module for acknowledgement letters sent to individual reporters to request clarification 
of missing or erroneous data; and 


to 


Referral of records to follow-up staff as described in the Follow-Up Section in this SOW for correction 
or completion of missing or erroneous data through follow-up activities. 


The Contractor shall maintain and update a list of currently available SARS-Cov-2 vaccines during the 
contract period. 


The Contractor shall maintain within the Relational Database Management System (RDBMS), a log of all 
manual edits of processed data, including deleted files, with date, editor, and nature of edit identified. All 
data contained in files deleted from the database shall be moved to a separate data set that shall remain 
available for review and retrieval. 


Any errors identified by the Contractor QA checks or Government shall be corrected in the database. 


QUALITY CONTROL AND ASSURANCE FOR SUBMITTED DATA QUALITY FOR SARS-CoV-2 VACCINE 
REPORTS 


A. 


The Contractor shali develop, demonstrate, document, and implement mechanisms to detect and request 
missing or discrepant data from the reporter. The requests shall be made in the form of report 
acknowledgment letters or other methods at the direction of or with the approval of the Government and 
shall present incomplete data fields and discrepant data for review and completion or correction by the 
reporter. 


The Contractor shall develop, demonstrate, document and implement mechanisms to detect, confirm, and 
link duplicate or redundant VAERS SARS-Co¥-2 vaccine reports conceming the same adverse event. 
These mechanisms will be implemented as follows: 


1. Initial data entry duplication search based on several key identifiers {e.g. name, date of birth, sex, 
vaccination date} 


2. Two times per week (or as specified by the Government) data entry duplication search on key 
identifiers, and adverse event. An adverse event is defined as a single “person vaccination event” or the 
combination of a patient, reported vaccine(s), and adverse event(s), submitted by one or more 
reporters. 


The following business rules and definitions shall apply to this activity: 


a. The first SARS-Co¥-2 vaccine report received by VAERS for a given adverse event shall be 
defined as the Primary Report. Other reports received after the Primary Report has been received 
and processed by the system shall be defined as Secondary Reports. 


b. Any SARS-Co¥V-2 vaccine reports received by VAERS after the Primary Report has been 
received, which are exact duplicates {photocopies or identical printouts or identical web based 
reports) of the Primary Report, shali be defined as Exact Duplicate Reports. These Exact 
Duplicate Reports shall be destroyed upon recognition. 


c. Any SARS-CoV-2 vaccine reports received by VAERS after the Primary Report has been 
received, which relate to the same “person vaccination event”, but which are not exact duplicates 
of the Primary Report, shail be defined as Redundant Reports. Redundant reports may originate 
from different reporters reporting the same “person vaccination event”, or may originate from the 
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same reporter as the Primary Report, or may provide different information about the adverse 
event, including information updates. 


d. All SARS-Co¥-2 vaccine reports that relate to the same “person vaccination event” shall be 
grouped together based on the VAERS ID for the Primary Report. 


e. The manner of identifying the Primary SARS-CoV-2 vaccine Report and all subsequent 
(Secondary) reports shall be as follows, unless otherwise indicated by the Government. The 
Primary Report shall have the VAERS ID assigned at the time the report is entered into the 
system, followed by the identifier “-1”. The first subsequent VAERS report concerning the same 
“person vaccination event” shall be assigned a “Linked Report” VAERS ID, which shall be the 
VAERS ID for the Primary Report, followed by the identifier “-2”, at the time the report is 
identified as a redundant report. The second subsequent VAERS report concerning the same 
“person vaccination event” shall be assigned a YAERS ID, which shall be the VAERS ID for the 
Primary Report, followed by the identifier “-3”, at the time the report is identified as a redundant 
report. Subsequent redundant reports shall continue to be numbered according to this pattern. The 
identifier digit following the hyphen shall be known as the “order number”. 


f. Assigning status regarding the serious nature (Item 21) on the VAERS form: death, life 
threatening illness, emergency room/department or urgent care visit, , hospitalization, prolongation 
of existing hospitalization, disability or permanent damage, congenital anomaly or birth defect, 
doctor or other health care professional office visit, none of the above) of the “person vaccination 
event” reported, as defined in 21 CFR 600.80, shall be based on the highest degree of severity for 
any of the reports received for a specific “person vaccination event”. The report with the highest 
degree of severity shail take precedence in the determination of serious/non-serious status if 
discrepancies exist between the original report and subsequent reports. If there is uncertainty 
regarding a report's status as being serious or non-serious, reports should generally be adjudicated 
in favor of serious status. 


As required, the Contractor shall develop, demonstrate, document, and implement a methodology by which 
data submitted by multiple reporters, in multiple documents from the same reporter, or obtained through 
follow-up or verification activities regarding the same event, are combined to create a composite table or 
tables which ioclude the reconciliation of conflicting information through follow-up with the reporter, 
health care provider or parent/vaccine recipient. The Contractor shall amend the primary report with 
information from subsequent multiple reports on the same adverse event (“person vaccination event”), 
based on the accuracy of the information (e.g. medical records, follow-up information) or Government 
approval. 


When a VAERS SARS-Co¥-2 vaccine report is identified as being a Redundant Report or Duplicate 
Report and has been reassigned a VAERS report identification number based on the VAERS ID for the 
Primary Report with appropriate identifier tag (e.g., YAERS ID = 123456-2), the Contractor shall retain the 
VAERS ID number which has been replaced (referred to here as “Old VAERS ID”) for the specific report 
in an accessible file for mapping to the current VAERS ID. 


The Old VAERS ID shall be retained in a data table linked to the primary VAERS database to allow for the 
search and identification of any specific VAERS report by either the first VAERS ID assigned (the Primary 
Report ID until a report is identified as Duplicate or Redundant) or subsequently reassigned Linked Report 
ID. 


The Contractor shall develop, demonstrate, document, and implement a coding variable (Patient Continuity 
Code) which shall be used to link a patient identified in a report to other reports in which that particular 
patient has been identified. Such reports may include Redundant and Duplicate Reports but may also 
include different “person vaccination events” regarding the same person, but a different vaccination and/or 
event. The Patient Continuity Code shall be included in the primary system database and in the 
Government Extract. 


Page 23 of 47 


The Contractor shall develop, demonstrate, document, and implement measures for batch-matching to 
identify redundant or secondary reports. The Contractor shall evaluate a variety of methods including 
“fuzzy logic” (http://en.wikipedia.org/wiki/Fuzzy_ logic) for identifying possible duplicate or redundant 
reports, including reports linked with minor name variations, and implement them at the Government’s 
discretion. An example of the use of fuzzy logic would be linking two different VAERS reports of a very 
rare occurrence in two patients who have the same birthdate and same date of vaccination but no name 
reported, into one VAERS report if the Contractor believes the two reports pertain to the same patient. 


H. The Contractor shali develop and maintain methods for confirming the quality of submitted data through 
standardized quality contro] and quality assurance procedures designed to reduce or eliminate the presence 
of more than one record concerning the same adverse event, data inconsistencies or deficiencies. 

I. With data provided by the Government, the Contractor shall develop and implement procedures to provide 
selection lists for valid vaccine lot identifiers (lot numbers) and data entry masks based on known lot 
numbers to provide information at the point of data entry as to the validity of the vaccine lot number 
entered. The Contractor shall develop and implement procedures to detect and specifically demarcate 
records containing reported vaccine lot identifiers, which are not valid lot numbers, based on comparison 
with lot identifier data provided by vaccine manufacturers through the FDA and provided to the contractor. 
These procedures shall be utilized for the Contractor internal data entry system. 

J. Upon provision of SARS-CoV-2 vaccine manufacturers’ lot numbers to the Contractor by the FDA, lot 
numbers in the database shall be flagged if not valid when compared to the manufacturer’s master data. 

K. Any errors identified by the Contractor QA checks or Government shouid be corrected in the data. 
QUALITY CONTROL AND ASSURANCE FOR SCANNED DATA QUALITY FOR SARS-CoV-2 VACCINE 
REPORTS 

A. The Contractor shali develop and maintain methods for assuring the quality of document images for the 


B. 


image database and correct indexing in the image database through standardized quality control and quality 
assurance procedures designed to confirm that documents are as legible as possible, complete, and capable 
of retrieval and copying from image base prior to final transfer of original physical document to the 
Government for archiving. 


Any errors identified by the Contractor QA checks or Government should be corrected in the data. 


QUALITY CONTROL AND ASSURANCE FOR CODED DATA QUALITY FOR SARS-CoV-2 VACCINE REPORTS 


A. 


The Contractor shall develop and maintain methods for assuring quality and consistency and the most 
current version of coding in Medical Dictionary for Regulatory Activities (MedDRA) (or other coding 
language chosen by the Government) and the accuracy and completeness of MedDRA coding submitted by 
manufacturers in their reports. The Contractor shall notify the Government of changes made to the 
MedDRA codes relevant to the VAERS data coding activities and provide a full report and summary of 
each updated version of MedDRA. 


The Contractor shali develop and implement a training program for all data entry and coding staff which 
shall require approval by the Government. The Contractor shall enforce a certification process that requires 
all coders to be trained and become certified coders for current code-based data. This shall include 
MedDRA, or another coding system chosen by the Government. The data system shail include a coder- 
signature field to indicate the specific coder staff person who performed the report coding. 


The Contractor shall develop or procure and use automated tools, such as auto-coding software, algorithms 
and aides, when available and approved by the Government, to assist in the coding process. 


The Contractor shall provide online manuals for coders to use at any time so that coders can access 
simulated scenarios and glean applicable codes. 


E. 


G. 


H. 
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The Contractor shall document any non-standard coding values in use by the VAERS program and 
submitted in reports. 


The Contractor shall implement QA procedures and reviews to ensure that data provided as part of 
Government data extracts meet pre-specified requirements as directed by the Government. Procedures for 
data entry error identification, correction and supplemental data entry should be established by the 
contractor in advance of any error detection by the Government. 


The Contractor shali develop and implement a QAP which shall include performance quality measures for 
each of the elements in this section of the SOW, and which shall require approval by the COR prior to 
implementation. The Contractor shall perform evaluation of these performance quality measures and report 
the results to the Government annually or on an alternate schedule as specified by the Government and 
propose procedure modifications as necessary to ensure data quality. The resultant modifications to QA 
procedures shail be periodically implemented contingent upon approval by the COR or CO. 


Any errors identified by the Contractor QA checks or Government shail be corrected in the data. 


QUALITY CONTROL UPDATES FOR SARS-CoV-2 VACCINE REPORTS 


A. 


The Government reserves the right to direct the Contractor to revise and update QA procedures in the QAP 
to support changes in reporting procedures, such as changes to the VAERS form, online reporting tool, or 
standard methods of reporting (i.e., transitioning to fully electronic reporting). 


Reasonable accominodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated QA procedures and the Contractor will be allowed to 
negotiate implementation of changes. 


TASK 5: INFORMATION MANAGEMENT FOR SARS-CoV-2 VACCINE REPORTS 


A. 


VAERS is an integrated system that encompasses information technology, data management, data 
analysis, software development lifecycle and IT security. The Contractor shall perform the following 
tasks/activilies: 


1. Maintain Capability Maturity Model (CMM) Level 3 certification or higher throughout the 
performance period of the contract and provide the Government current documentation of its CMM 
Level 3 or higher certification. 


N 


Maintain current system operations 
3. Provide software development, enhancement and progress reviews as requested by the Government. 


4. Provide software documentation inclusive but not limited to systems requirements, specifications, 
architecture details, design details, analytical algorithms, data models, and technical support processes. 
All documentation shall be submitted to the Government in each annual report and during and 
following the implementation of system changes. 


nat 


Provide data extractions and depersonalized data sets requested by the Government on a routine and 
ad-hoc basis 


6. Provide ad hoc searches of VAERS SARS-CoV-2 vaccine data as requested by the Government 


7. Implement appropriate Government policies and regulatory requirements regarding information 
management, information technology, software development, and security. 
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B. The Contractor shall furnish all necessary personnel, facilities, supplies, and equipment, as appropriate, to 
provide the Government with required technical, and operational services, within the general work 
parameters set forth in this Statement of Work. 


VAERS SARS-CoV-2 SYSTEM SPECIFICATIONS 


A. The VAERS system shall be hosted on an offsite network consisting of CDC owned software, commercial 
off the shelf software (COTS), and owned and leased hardware. The VAERS Servers will be categorized 
into core, non-core and infrastructnre systems. Core systems are those identified with core business 
functionality, non-core provides support for the core systems. The infrastructure servers will provide 
centralized security, network, authentication, storage, remote access and management of all the VAERS 
environments. These servers may consist of a combination of physical and virtual servers, though virtual 
servers are recommended. 


The VAERS architecture should consist of two separate Security Sockets Layer (SSL) virtual private 
networks (VPN), one contains the production and software development lifecycle (SDL) environment, and 
the second located offsite contains a disaster recovery environment. The disaster recovery site is a 
duplicate and replication of the production site and provides recovery of the production site within 24 hours 
(refer to Task 1: ADMINISTRATIVE for physical location requirements for the offsite environment for 
disaster recovery, i.e., the disaster recovery site}. 


Below is an example of the approximate number of development, testing and user acceptance servers 
needed for the system: 


Infrastructure 


B. Software to be installed on these machines includes but is not limited to: 


Activator, ColdFnsion, Apache, Biscom FAXCOM, CentOS Enterprise Linux, Chado Software, SpellText, 
Cisco ASA software, Cisco IOS, CopSSH, Doubletake, Express Metrix, Faxcom, HP Array Configuration 
Utility, IBM Rational Tools, Itefix CopSSH, Java, Jpeg Wizard, Kofax Capture, Macromedia CFMX, 
Medical/Pharmaceutical Spellchecker, Microsoft Active Directory, Microsoft Remote Desktop Version 10, 
Microsoft Windows server 2016, Microsoft HS, MS Office, MS OS, Microsoft SQL 2017, Microsoft VSS, 
NSClient++, PHINMS, Python, rDist, Redhat Enterprise Linux, rSync, RSA Authentication Manager, RSA 
Radius Server, SAS, Screen, SourceForge GNU Win32, SpellText, Stedman’s spellchecker, Superflexible, 
Symantec Backup Exec Agent, Symantic Antivirus, Tripwire for Servers, VMWARE, Zope 


Contractor must license or own software (or equivalent) as listed above. 


C. Contractor must develop a VAERS Virtual Private Networks (VPN) which allows authorized users located 
outside of the Contractor’s facility to establish a secure connection to the VAERS application. The 
VAERS VPNs will provide a secure computer network that uses the Internet to allow remote users secure 
access to the VAERS application and database. It should encapsulate data transfers each business day, 
between the authorized users and Contractor’s networked devices to keep transferred data private from 
other devices on one or more intervening local or wide area networks. Depending on the user’s access 
rights to the VAERS database, the individual will either be part of a YPN with full access to the VAERS 
database or a more restricted VPN only providing access to reports of selected research interest. The 
Contractor adheres to the following and is expected to create and maintain capabilities to perform these 
functions: 
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Conduct web based query 

Enable viewing of scanned images 

Enable viewing of entered data including Follow up and MedDRA code 
Enable viewing of nurse follow up module 


D. Other VAERS functionality requirements include: 


1. Creation of a VAERS SARS-CoV-2 vaccine public website and online reporting tool which 
includes a mechanism for allowing patients, parents, providers and other partners and stakeholders 
to electronically submit VAERS reports 


2. Creation of an intranet appiication that allows authorized staff to access SARS-CoV-2 vaccine 
reports to query, add and modify data, and view linked images 


3. Double data entry of specific report types as determined by the Government 


4. Scanning of hard copy documents including, but not limited to, VAERS SARS-CoV-2 vaccine 
report and medical documentation. 


5. Receipt of electronic SARS-CoV-2 vaccine reports from manufacturers (eVAERS) 


6. Electronic transmission of reports and data extractions to CDC and FDA as specified by the 
Government 


7. Business Intelligence 

8. Data warehousing 

9, Data editing 

10. Duplicate identification 

11. Database management system and tools 

12. Software for extracting and transmission of Government specified data sets. 
DATA MANAGEMENT 


A. All Information Technology (IT) systems must comply with federal regulations and policies regarding IT 
which includes but are not limited to Enterprise Performance Life Cycle (EPLC), Capital Planning and 
Investment Control (CPIC), Information Security, Section 508 of the Rehabilitation Act, Enterprise 
Architecture (EA), etc. 


B. These methods, procedures and processes will accept reports submitted by business partners including 
manufacturers, state health coordinators, and other immunization programs, other Federal Government 
agencies and programs, and other parties. 

Electronic manufacturer reports include post-marketing adverse drug reaction (ADR) data for individual 
cases, post-marketing expedited ADR reports and periodic ADR reports. Electronic manufacturer reports 
shal] conform to the format and processes identified and implemented by the US Food and Drug 
Administration (FDA). This reporting process is referred to as eVAERS. 


C. Under the direction of the CO and COR, the Contractor shall establish and maintain methods, procedures 
and processes to support a variety of Electronic Data Interchange (EDI) message types to be specified by 
the Government. The contractor will work with SARS-CoV-2 vaccine manufacturers (approved by 
Government), to ensure electronic submission of postmarket individual case safety reports (ICSRs) to 
VAERS using E2B(R3) and submitting via xml format. Electronic reporting of vaccine postmarketing 
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safety reports shall follow the International Council on Harmonisation’s (ICH) E2B(R3) ICSR specification 
: https://www.federalregister.gov/documents/2014/06/10/2014-13480/postmarketing-safety-reports-for- 
human-drug-and-biological-products-electronic-submission 


STANDARDIZED METHODS FOR PROVIDING ROUTINE AND REQUESTED REPORTS OF VAERS SARS-CoV- 
2 VACCINE DATA TO THE GOVERNMENT 


A. The Contractor shall perform ad hoc searches of the VAERS SARS-COV-2 vaccines databases to address 
specific surveillance questions and support vaccine safety studies, as requested by the Government. 


B. At the direction of the Government the Contractor shali develop, maintain and update programs to 
routinely produce specific depersonalized data sets containing originally reported information for the public 
websites, World Health Organization (WHO), state health coordinators and others as approved by the 
Government. 


C. The Contractor shall provide a weekly reports of adverse events after SARS-CoV-2 vaccines reported for 
specific jurisdictions via The Epidemic Information Exchange {Epi-X) to those specific State Health 
Coordinators as indicated by the Government, upon request by the Government. 


These reporting requirements are subject to change at the request of the government. 
GOVERNMENT DATA EXTRACTS FOR SARS-CoV-2 VACCINE REPORTS 


A. The quality of the data extract is important to VAERS, therefore, the Contractor shall provide accurate data 
extract (“Government Extract”) to the Government for storage and use at Government sites (both CDC and 
FDA). The data extract and all available data clements collected from the submission of VAERS reports 
and collected through follow-up activities are subject to the approval of the Government and should be 
provided according to the specified timeframes detailed in Appendix A. The complete VAERS SARS-Cov- 
2 vaccine database, containing both (a) ali data elements from the VAERS form which include those data- 
elements historically used by the Government, and (b) any new and valuable data-elements added by the 
Contractor by the direction of the Government shail be provided daily. All data elements collected on the 
VAERS form (and subsequent approved revisions of the VAERS form), and subsequent data elements 
collected via internal entry system or web system, are subject for inclusion in the data extract to 
Government. If the data element is a specific field on the form, the data shall be stored in a related specific 
field in the Government data, with no concatenation of data fields or elements. The following are examples 
of two processes for important extracts of data from the VAERS system that the Contractor shali follow: 


1. VAERS SARS-Co¥-2 VACCINE DAILY EXTRACT - Each business day, the Contractor shall send 
an extract to the CDC and FDA through a low cost data transmission application. Once CDC receives 
the extract, a confirmatory e-mail is submitted to the Contractor verifying that the extract has been 
received. The Contractor shall contact the COR if the confirmatory e-mail is not received. The COR 
will contact the Contractor if there is a problem uploading and processing the data. The Contractor 
shall adhere to the following: 


e Include initial report data and data obtained in follow up 
e Provide data in a format approved by the Government (CSV format) 
e Maintain manufacturer reports received electronically including postmarketing adverse drug 


reaction (ADR) data for individual cases, post marketing expedited ADR reports and periodic 
ADR reports. 


No 


VAERS SARS-CoV-2 VACCINE PUBLIC EXTRACTS - The Contractor shall be required to 
maintain public redacted databases of VAERS data as specified by the Government. The current 
VAERS public website (www.vaers.hhs.gov) provides downloadable datasets that are subsets of the 
VAERS daily extract that is sent to the CDC and FDA. WONDER, a CDC created online tool located 
at wonder.cdc.gov, is another example of the public databases, This tool allows the public to query a 
subset of the VAERS data. Standard operating procedures are used to ensure patient privacy. The 
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public website and WONDER shail be updated on a weekly basis. There is a one week Jag on data so 
that quality contro] measures can be conducted by the Contractor. The datasets on the public website 
are split into separate CS¥ files by years dating from 1990 to the current year. Non-domestic (.e., 
foreign) reports are placed in a separate CSV file. 


3. WAERS SARS-CoV-2 VACCINE OTHER GOVERNMENTAL AGENCIES EXTRACTS- The 
Contractor shall provide VAERS data in comma separated value (CSV) files on a secure server 
platform to specified points of contact among other governmental agencies, Department of Defense 
(DoD), Indian Health Services (IHS), and World Health Organization (WHO), on a weekly basis. 

a. DoD and non-DoD reports will be identified using specific search criteria as outlined in VAERS 
CDC DoD Memorandum of Agreement (MOA). Initial and follow-up unredacted information 
will be provided on DoD reports, while initial redacted information will be provided on non-DoD 
reports. 

b. IHS and non-IHS reports will be identified using specific search criteria as outlined in VAERS 
CDC IHS Memorandum of Understanding (MOU). Initial and follow-up unredacted information 
will be provided on IHS reports, while initial redacted information will be provided on non-[HS 
reports. 

c. WHO will be provided initial redacted information, similar to data publicly available at the CDC 
WONDER website: https://wonder.cde.gov/vaers.html. 


4. VAERS SARS-CoV-2 VACCINE JURISDICITON EXTRACTS- The Contactor shall provide 
VAERS SARS-CoV-2 vaccine data and summary tables to specified jurisdictions using CDC’s 
Epidemic Information Exchange (Epi-X), a secure, web-based network that serves as a powerful 
information exchange between CDC and public health professionals involved in idenufying, 
investigating, and responding to public health threats. Data will be posted and refreshed on a weekly 
basis with a one week Jag in order to incorporate quality control measures conducted by the 
Contractor. The VAERS SARS-CoV-2 vaccine data will include initial report data with personal 
identifiers, no follow-up will be included. Summary tables will also be provided to the jurisdictions, 
including summary statistics, including but not limited to, serious status and conditions of interest. 


VAERS FUTURE SOFTWARE DEVELOPMENT AND ENHANCEMENTS 


A. 


At the request of the Government, the Contractor shall develop and enhance software for the VAERS 
system following the HHS, CDC and NCEZID policies and procedures for Enterprise Performance Life 
Cycle (EPLC), Capital Planning and Investment Control (CPIC) and IT security. 
http://www.hhs.gov/ocio/policy/index.html 


CONTRACTOR COMPLIANCE WITH APPLICABLE LAWS, REGULATIONS, POLICIES AND STANDARDS 


A. 


D. 


The Contractor shall ensure that the Information Technology Architecture (ITA) for the VAERS system is 
implemented and maintained by the Contractor in compliance with applicable regulations including OMB 
Circular A-130, the Federal Information Resources Management Regulation (FIRMR), the DHHS 
Automated Information Systems Security Program (AISSP) Handbook, and applicable portions of the CDC 
ITA plan, Technical Reference Model and Standards. 


IT products and technologies procured through this contract shall meet the applicable accessibility 
standards at 36 CFR 1194, viewable at https://www.gpo.gov/fdsys/granule/CFR-201 1-title36-vol3/CFR- 


2011-title36-vol3-part1194/content-detail.html 


The Contractor shall ensure that all systems are in compliance with Section 208, the privacy provisions of 
the E-Government Act of 2002, and follow the OMB Guidance of September 26, 2003 regarding 
implementation of the privacy provisions of the E-Government Act. 


The Contractor shall be responsible for being aware of and shail comply with ail applicable federal 
information technology and information management laws, regulations, policies, and standards. These 
include but are not limited to: 
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e Children’s Online Privacy Protection Act (COPPA) 

e = Section 508 of the Rehabilitation Act. HHS Section 508 Prodnct Assessment Template (nse 
VPAT version 2.0 or later: https://www.itic.org/policy/accessibility/vpat } 

Clinger-Cohen Act (CCA 

Federal Information Security and Management Act (FISMA) 

Paperwork Reduction Act (PRA 

Office of Management and Budget (OMB), National Institute of Standards and Technology 
(NIST), and General Accounting Office (GAO) policies that can be primarily found at or 
through the Federal CIO Council website at www.cio.gov. 

e Federal Enterprise Architecture (FEA) 


E. The Contractor shall not develop any Internet web applications that use persistent cookies without explicit 
authorization by CDC’s Chief Information Officer. 


F. The Contractor shall adhere to CDC’s Secure Coding Practices gnide for developing web-based 
applications to prevent security vulnerabilities. 


G. Contractor's performance and resulting deliverables shall adhere to all federal, HHS, and/or CDC IT 
security policies and procednres. Development or implementation of an electronic information system or 
any electronic data collection effort conducted in the performance of this contract is required to undergo 
Certification and Accreditation (C&A) prior to operation. When applicable, the Contractor shall be 
required to complete all security documentation and materials required to obtain an authority to operate 
(ATO). The Contractor shall comply with all applicable HHS, CDC, FISMA, HIPPA, NIST, and other 
federal policies and regulations in the performance of the security requirements. If an application or system 
is operated by the Contractor on behalf of the Government and/or hosted at a Contractor facility, it shall 
comply with HHS and CDC policies, and is subject to all OMB requirements, including a full Certification 
and Accreditation (C&A) 


Y. TASK ORDER DELIVERABLES AND MILESTONES: 


Deliverable 


Program Management Monthiy Status Report as leach tothe | Monthly, first report due 30 days after 
specified in the Administrative section of the COR and TR | contract award 
SOW 
Annual report as specified in the Administrative leach tothe | Annually, due 30 days following the 12 
section of the SOW COR. TR and | months period covered by report 

CO 


Draft Final Report as specified in the l each tothe | Atleast 45 days before the contract 
Administrative section of the SOW. COR and TR | completion date 


Final Report as specified in the Administrative l each tothe | No later than the contract completion 
section of the SOW COR, TR and | date 

CO 
Report inventory of all hardware and software, l each to the | Include in annual report and upon 
including version numbers of software and record | COR and TR | request 
of maintenance as specified in Security section of 
the SOW 
Develop/update and provide standard operating leach tothe | Within 30 days after contract award, 
procedures for all aspects of VAERS operations, COR and TR | within 30 days of implementation of 
including complete VAERS report processing, as changes, and then annually and upon 
specified in the Administrative section of the request 


Deliverable 


Develop and maintain list of names, phone 
numbers, fax numbers, and email addresses of 
contact personnel responsible for reporting from 
state health agencies, vaccine manufacturers, and 
immunization programs as specified in 
Administrative section of the SOW 

Report number, method of contact, type of 
contact with VAERS by manufacturers, state 
health coordinators, immunization programs, and 
the public. 

Provide documentation of the technical procedure 
for data transport to Government as specified in 
the Information Management section of the SOW. 
Provide Government Extract of VAERS data to 
both agencies as specified in the Information 
Management section of the SOW. 

Maintain and provide docusnentation for a 
current, separate mirror version of the VAERS 
system and RDBMS as specified in SOW. 
Provide user-procedure manual(s) and standard 
operating procedures (manual of operations) for 
technical aspects of VAERS database operations 
Provide documentation for data verification 
procedures including standardized letters, forms, 
logs, phone scripts and other documents as 
specified in SOW 

Provide a weekly report of adverse events after 
SARS-Co¥-2 vaccines to Vaccine Safety 
Coordinators and their designees of specific 
Jurisdictions as indicated by the Government as 
specified in SOW 

Provide documentation for procedures and rules 
for Data Quality Control and Assurance as 
specified in SOW 

Provide System Security Plan and training 
materials for employee AIS security training 
program as specified in the Information 
Management section of the SOW 

Provide Program Management Plan as specified 
in the Administrative section of the SOW 
Provide Quality Assurance Program (QAP) plan 
as specified in SOW 


Provide list of key project personnel as specified 
in SOW 
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l each to the | Within 30 days after contract award, 
COR and TR | then annually, and upon Government 
request. 


l each to the 
COR and TR 


Include in the annual report, and upon 
Government request 


1 each to the 
COR and TR 


Within 30 days after contract award 


l each to FDA | Beginning 30 days after contract 
and CDC award, and each business day thereafter 
designees 
1 Each to the 
COR and TR 


Within 90 days after contract award 


1 each to the 
COR and TR 


30 days after contract award and then 
as specified in SOW 


1 each to the 
COR and TR 


Upon Government request 


1 each to the 
COR and TR 


Weekly, beginning 60 days after 
contract award 


1 each to the 
COR and TR 


Provide 60 days after contract award 
then annuaily or upon request 


1 each to the 
COR and TR 


Within 30 days after contract award, 
then annually 


l each to the | Within 30 days after contract award, 
leach tothe | Within 30 days after contract award, 
COR, TR and | then annually 
CO 
leachtothe | Within 30 days after contract award, 
then annually; update within 10 days 
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pO | Following key personnel changes 


Provide Earned Value Report as specified in leachtothe | Include in monthly reports 
Information Management and Administrative COR and TR 

sections of SOW 

Provide Data System Security Plan or information | 1 each tothe | Draft within 30 days after contract 
system security plan (SSP) as specified in CO and COR | award; final version within 60 days 
Information Management section of SOW after award. 

Provide list of staff who have successfully 1 to COR Upon request by COR 

completed information security training as 

specified in Information Management section of 

SOW 

Provide documentation of Level 3 Security l each to COR | Within 30 days after contract award 
Requirements compliance as specified in the and TR 

Information Management section of SOW. 


Provide Transition-Out Plan for approval as leach tothe | Within 60 days after contract award 
specified in the Adininistrative section of SOW COR and TR 


Provide Disaster Recovery Plan for approval as ł each to the | Within 60 days after contract award 

specified in the Information Management section COR and TR 

of SOW 

Provide results of IT Security Risk Management leach tothe | Within 45 days of completed 

Assessment as specified in the Information COR and TR | assessment 

Management section of SOW 

Provide the Government with detailed system leach tothe | Within 30 days after contract award, 

documentation. Documentation shall be COR and TR | then annually thereafter, with new 

maintained in two separate volumes: “Volume | sections or documentation revisions 

— VAERS Business Processes” and “Volume 2 — provided within 10 days 

VAERS IT Requirements and Design” as 

specified in the Administrative section of SOW 

Provide detailed documentation of the technical leach tothe | Within 30 days after contract award, 

procedures for data transport to CDC and FDA as | COR and TR | then annually thereafter, with new 

specified in the Administrative section of SOW sections or documentation revisions 
provided within 10 days 


The Contractor shall provide, upon request from the Government, deliverables not specificaily listed in this 
document. The Government will provide the Contractor with sufficient time (i.e., a minimum of 2 business days) to 
fulfill such requests, 


VI. PERFORMANCE MATRIX: 


Desired Required ; Acceptable Monitoring - Incentiyes/ 
aleam Services SLA Performance uality Method isine 

Standard 2 Disincentives 

Level (AQL) (Quality 
(completeness, cost, a 
ace Assurance 
reliability, accuracy, Surveill 
timeliness, quality) 


Plan/QASP) 
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Desired Required À Acceptable Monitoring Incentives/ 
Outcomes Services a | a slice Method Disincentives 
Standard A 
Level (AQL) (Quality 
(completeness, cost, 
teliability, accuracy, — RDE 
Emelies. q uality) | Surveillance 
J | Plan/QASP) 
Execute/perform | Meets and | All required tasks, | 100% | COR oversight | Favorable or 
all required tasks | complies with | milestones and compliance Unfavorable 
according to defined task deliverables will be Performance 
performance plan | requirements | achieved within the Evaluation 
agreed-upon 
schedule specified in 
this Statement of 
Work 
Send timely | Each business | All required tasks, | 98% Daily receipt of | Favorable or 
VAERS Daily day the milestones and compliance Extract Unfavorable 
Extracts with Contractor deliverables will be Performance 
correct sends an achieved within the Evaluation 
information extract to the | agreed-upon 
CDC and schedule specified in 
FDA through | this Statement of 
the PHINMS | Work 
or other 
specified 
| application. 
Process all | Process — All required tasks, | 100% Menthly | Favorable or 
serious reports serious milestones and compliance Quality Reports | Unfavorable 
within the reports inthe | deliverables willbe | All late Performance 
specified established achieved within the | logging of Evaluation 
timeframe timeframe to | agreed-upon adverse 
reflected in electronically | schedule specified in | events 
Appendix A of migrate VAE | this Statement of reports is 
this SOW. data into the Work reported in 
database. monthly 
report. 


VIL PERIOD OF PERFORMANCE: 


Base: 27 August 2020 — 26 August 2021 
Option: 27 August 2021 — 26 August 2022 


VIII PLACE OF PERFORMANCE: 


The work will be conducted at the contractor’s facility, 


IX. EQUIPMENT AND INFORMATION: 
The Contractor shall provide hardware, software, office and communications equipment and other resources to be 
used for data receipt, processing, editing, analysis, reporting, transmission, and storage. The Contractor shall 
provide the Government with current and detailed system documentation, including SOPs for all aspects of VAERS 
program operations, including complete VAERS report processing, submitted to the Government for initial review 
and approval within 30 days after contract award and within 30 days of revision or implementation of changes, and 
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minimally on an annual basis or as requested by the Government thereafter. Please see Task Order | 
(Administrative) for more detail. 
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Appendix A: VAERS triaging of reports in business days!” 


l 


1.Subject to change in response to new public health policies and/or events and/or funding availability after discussion between CDC and FDA 
2. Not applicable for GBS reports where a patient is confined to facility longer than the time allowed for follow-up (e.g.. patient in rehabilitation 
after GBS) 

3. Completion includes scanning, data entry, and coding 

4. If final autopsy report is not received within 2 months, make request every 2 months 

5, [f no records received within 5 days from the original request, make another request for Covid-19 
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CLAUSES 


In addition to the GSA schedule contract clauses, the following clauses are incorporated: 


§2.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or 
Equipment (AUG 2019) 


(a) Definitions. As used in this clause— 
Covered foreign country means The People’s Republic of China. 
Covered telecommunications equipment or services means- 


(1) Telecommunications equipment produced by Huawei Technologies Company or ZTE Corporation (or any 
subsidiary or affiliate of such entities}; 


(2) For the purpose of public safety, security of Government facilities, physical security surveillance of critical 
infrastructure, and other national security purposes, video surveillance and telecommunications equipment produced 
by Hytera Communications Corporation, Hangzhou Hikvision Digital Technology Company, or Dahua Technology 
Company (or any subsidiary or affiliate of such entities); 


(3) Telecommunications or video surveillance services provided by such entities or using such equipment; or 


(4) Telecommunications or video surveillance equipment or services produced or provided by an entity that the 
Secretary of Defense, in consultation with the Director of National Intelligence or the Director of the Federal Bureau 
of Investigation, reasonably believes to be an entity owned or controlled by, or otherwise connected to, the 
government of a covered foreign country. 


Critical technology means- 


(1) Defense articles or defense services included on the United States Munitions List set forth in the International 
Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations; 

(2) Items included on the Commerce Control List set forth in Supplement No. | to part 774 of the Export 
Administration Regulations under subchapter C of chapter VII of title 15, Code of Federal Regulations, and 
controlled— 


i (i) Pursuant to multilateral regimes, including for reasons relating to national security, chemical and 
biological weapons proliferation, nuclear nonproliferation, or missile technology; or 


i (ii} For reasons relating to regional stability or surreptitious listening: 
(3) Specially designed and prepared nuclear equipment, parts and components, materials, software, and technology 
covered by part 810 of title 10, Code of Federal Regulations (relating to assistance to foreign atomic energy 


activities); 


(4) Nuclear facilities, equipment. and material covered by part 110 of title 10, Code of Federal Regulations (relating 
to export and import of nuclear equipment and material); 


(5) Select agents and toxins covered by part 331 of title 7, Code of Federal Regulations, part 121 of title 9 of such 
Code, or part 73 of title 42 of such Code; or 


(6) Emerging and foundational technologies controlled pursuant to section 1758 of the Export Control Reform Act 
of 2018 (50 U.S.C. 4817). 


Substantial or essential component means any component necessary for the proper function or performance of a 
piece of equipment, system, or service. 
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(b) Prohibition. Section 889(a)(1)(A) of the John S$. McCain National Defense Authorization Act for Fiscal Year 
2019 (Pub. L. 115-232) prohibits the head of an executive agency on or after August 13, 2019, from procuring or 
obtaining, or extending or renewing a contract to procure or obtain, any equipment, system, or service that uses 
covered telecommunications equipment or services as a substantial or essential component of any system, or as 
critical technology as part of any system. The Contractor is prohibited from providing to the Government any 
equipment, system, or service that uses covered telecommunications equipment or services as a substantial or 
essential component of any system, or as critical technology as part of any system, unless an exception at paragraph 
(c) of this clause applies or the covered telecommunication equipment or services are covered by a waiver described 
in Federal Acquisition Regulation 4.2104. 


(c) Exceptions. This clause does not prohibit contractors from providing— 


(1) A service that connects to the facilities of a third-party, such as backhaul, roaming, or interconnection 
arrangements; or 


(2) Telecommunications equipment that cannot route or redirect user data traffic or permit visibility into any 
user data or packets that such equipment transmits or otherwise handles. 


(d} Reporting requirement. 


{1) In the event the Contractor identifies covered telecommunications equipment or services used as a 
substantial or essential component of any systein, or as critical technology as part of any system, during 
contract performance, or the Contractor is notified of such by a subcontractor at any tier or by any other 
source, the Contractor shall report the information in paragraph (d)(2) of this clause to the Contracting 
Officer, unless elsewhere im this contract are established procedures for reporting the information; in the 
case of the Department of Defense, the Contractor shall report to the website at https://dibnet.dod.mil. For 
indefinite delivery contracts, the Contractor shall report to the Contracting Officer for the indefinite 
delivery contract and the Contracting Officer(s) for any affected order or, in the case of the Department of 
Defense, identify both the indefinite delivery contract and any affected orders in the report provided at 
https://dibnet.dod.mil. 


(2) The Contractor shall report the following information pursuant to paragraph (d)(1} of this clause: 


(i) Within one business day from the date of such identification or notification: the contract number; the 
order number(s}, if applicable; supplier name; supplier unique entity identifier (if known); supplier 
Commercial and Government Entity (CAGE) code (if known); brand; model number (original 
equipment manufacturer number, manufacturer part number, or wholesaler number); item description: 
and any readily available information about mitigation actions undertaken or recommended. 


(ii) Within 10 business days of submitting the information in paragraph (d)(2){i) of this clause: any further 
available information about mitigation actions undertaken or recommended. In addition, the Contractor 
shall describe the efforts it undertook to prevent use or submission of covered telecommunications 
equipment or services, and any additional efforts that will be incorporated to prevent future use or 
submission of covered telecommunications equipment or services. 


(e) Subcontracts. The Contractor shall insert the substance of this clause, including this paragraph (e), in all 
subcontracts and other contractual instruments, including subcontracts for the acquisition of commercial items. 


(End of clause) 


52.217-8 Option to Extend Services (Nov 1999) 


The Government may require continued performance of any services within the limits and at the rates specified in 
the contract. These rates may be adjusted only as a result of revisions to prevailing labor rates provided by the 
Secretary of Labor. The option provision may be exercised more than once, but the total extension of performance 
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hereunder shall not exceed 6 months. The Contracting Officer may exercise the option by written notice to the 
Contractor within 30 days. 


{End of Clause) 
52.217-9 Option to Extend the Term of the Contract (Mar 2000) 


(a) The Government may extend the term of this contract by written notice to the Contractor within 30 days; 
provided, that the Government gives the Contractor a preliminary written notice of its intent to extend at least 30 
days before the contract expires. The preliminary notice does not commit the Government to an extension. 


(b) If the Government exercises this option, the extended contract shall be considered to include this option clause. 


(c) The total duration of this contract, including the exercise of any options under this clause, shall not exceed 60 
months. 


{End of Clause} 


CDC 42.0002 Evaluation of Contractor Performance Utilizing CPARS (April 2013) 

In accordance with FAR 42.15, the Centers for Disease Control and Prevention (CDC) will review and evaluate 
contract performance. FAR 42.1502 and 42.1503 requires agencies to prepare evaluations of contractor 
performance and submit them to the Past Performance Information Retrieval System (PPIRS). The CDC utilizes the 
Department of Defense (DOD) web-based Contractor Performance Assessment Reporting System (CPARS) to 
prepare and report these contractor performance evaluations. Ali information contained in these assessments may be 
used by the Government, within the limitations of FAR 42.15, for future source selections in accordance with FAR 
15.304 where past performance is an evaluation factor. 


The CPARS system requires a contractor representative to be assigned so that the contractor has appropriate input 
into the performance evaluation process. The CPARS contractor representative will be given access to CPARS and 
will be given the opportunity to concur or not-concur with performance evaluations before the evaluations are 
complete. The CPARS contractor representative will also have the opportunity to add comments to performance 
evaluations. 


The assessment is not subject to the Disputes clause of the contract, nor is it subject to appeal beyond the review and 
comment procedures described in the guides on the CPARS website. Refer to: www.cpars.gov for details and 
additional information related to CPARS, CPARS user access, how contract performance assessments are 
conducted, and how Contractors participate. Access and training for all persons responsible for the preparation and 
review of performance assessments is also available at the CPARS website. 


The contractor must provide the CDC contracting office with the name, e-mail address, and phone number of their 
designated CPARS representative who will be responsible for logging into CPARS and reviewing and commenting 
on performance evaluations. The contractor must maintain a current representative to serve as the contractor 
representative in CPARS. It is the contractor’s responsibility to notify the CDC contracting office, in writing (letter 
or email), when their CPARS representative information needs to be changed or updated. Failure to maintain 
current CPARS contractor representative information will result in the loss of an opportunity to review and 
corninent on performance evaluations. 


{End of Clause} 


Non-Disclosure Agreement for Contractor and Contractor Employees (May 2009) 
The contractor shall prepare and submit a Non-Disclosure Agreement (NDA) to the Contracting Officer prior to 
access of government information or the commencement of work at CDC. 


{a) The NDA made part of this clause, exhibit I and II, is required in service contracts where positions and/or 
functions proposed to be filled by contractor’s employees will have access to non-public and procurement- 
sensitive information. The NDA also requires contractor’s employees properly identify themselves as 
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employees of a contractor when communicating or interacting with CDC employees, employees of other 
governmental entities (when communication or interaction relates to the contractor’s work with the CDC), 
and members of the public. The Federal Acquisition Regulation (FAR) 37.114 (c), states “All contractor 
personne! attending meetings, answering Government telephones, and working in other situations where 
their contractor status is not obvious to third parties are required to identify themselves as such to avoid 
creating an impression in the minds of members of the public or Congress that they are Government 
officials, unless, in the judgment of the agency, no harm can come from failing to identify themselves. 
They must also ensure that all documents or reports produced by contractors are suitably marked as 
contractor products or that contractor participation is appropriately disclosed.” 


{b) The Contractor shall inform employees of the identification requirements by which they must abide and 
monitor employee compliance with the identification requirements. 


{c) During the contract performance period, the Contractor is responsible to ensure that all additional or 
replacement contractors’ employees sign an NDA and it is submitted to the Contracting Officer prior to 
commencement of their work with the CDC. 


{d) Contractor employees in designated positions or functions that have not signed the appropriate NDA shall 
not have access to any non-public, procurement sensitive information or participate in government meeting 
where sensitive information may be discussed. 


{e) The Contractor shall prepare and maintain a current list of employees working under NDA's and submit to 
the Contracting Officer upon request during the contract period of performance. The list should at a 
minimum include: contract number, employee’s name, position, date of hire and NDA requirement. 


{End of Clause) 


352.203-70 Anti-Lobbying. (December 18, 2015) 
Pursuant to the HHS annual appropriations acts, except for normal and recognized executive-legislative 
relationships, the Contractor shali not use any HHS contract funds for: 


(a) Publicity or propaganda purposes; 


(b) The preparation, distribution, or use of any kit, pamphlet, booklet, publication, electronic communication, radio, 
television, or video presentation designed to support or defeat the enactment of legislation before the Congress or 
any State or local legislature or legislative body, except in presentation to the Congress or any state or local 
legislature itself; or designed to support or defeat any proposed or pending regulation, administrative action, or order 
issued by the executive branch of any state or local government, except in presentation to the executive branch of 
any state or local government itself; or 


(c) Payment of salary or expenses of the Contractor, or any agent acting for the Contractor, related to any activity 
designed to influence the enactment of legislation, appropriations, regulation, administrative action, or Executive 
order proposed or pending before the Congress or any state government, state legislature or local legislature or 
legislative body, other than for normal and recognized executive-legislative relationships or participation by an 
agency or officer of a state, local, or tribal government in policymaking and adiministrative processes within the 
executive branch of that government. 


(d) The prohibitions in subsections (a), (b), and (c) above shall include any activity to advocate or promote any 
proposed, pending, or future federal, state, or local tax increase, or any proposed, pending, or future requirement for, 
or restriction on, any legal consumer product, including its sale or marketing, including, but not limited to, the 
advocacy or promotion of gun control. 


(End of ciause) 


47QTCK18D0003 75D30120F09621 
Page 39 of 47 


352.222-70 Contractor Cooperation in Equai Employment Opportunity Investigations. (December 18, 2015) 


(a) In addition to complying with the clause at FAR 52.222-26, Equal Opportunity, the Contractor shall, in good 
faith, cooperate with the Department of Health and Human Services (Agency) in investigations of Equal 
Employment Opportunity (EEO) complaints processed pursuant to 29 CFR part 1614. For purposes of this clause, 
the following definitions apply: 


(1) Complaint means a formal or informal complaint that has been lodged with Agency management, Agency EEO 
officials, the Equal Empioyment Opportunity Commission (EEOC), or a court of competent jurisdiction. 


(2) Contractor employee means all current Contractor employees who work or worked under this contract. The term 
also includes current employees of subcontractors who work or worked under this contract. In the case of Contractor 
and subcontractor employees, who worked under this contract, but who are no longer employed by the Contractor or 
subcontractor, or who have been assigned to another entity within the Contractor’s or subcontractor’s organization, 
the Contractor shall provide the Agency with that employee’s last known mailing address, e-mail address, and 
telephone number, if that employee has been identified as a witness in an EEO complaint or investigation. 


(3} Good faith cooperation cited in paragraph (a) includes, but is not limited to, making Contractor employees 
available for: 


(i) Forinal and informal interviews by EEO counselors or other Agency officials processing EEO complaints; 


(ii) Formal or informal interviews by EEO investigators charged with investigating complaints of unlawful 
discrimination filed by Federal employees; 


(iii) Reviewing and signing appropriate affidavits or declarations summarizing statements provided by such 
Contractor employees during the course of EEO investigations; 


(iv) Producing documents requested by EEO counselors, EEO investigators, Agency employees, or the EEOC in 
connection with a pending EEO complaint; and 


(v) Preparing for and providing testimony in depositions or in hearings before the MSPB, EEOC and U.S. District 
Court. 


(b) The Contractor shall include the provisions of this clause in all subcontract solicitations and subcontracts 
awarded at any lier under this contract. 


(c) Failure on the part of the Contractor or its subcontractors to comply with the terms of this clause may be grounds 
for the Contracting Officer to terminate this contract for default. 


(End of clause) 


352.233-71 Litigation and Claims. (December 18, 2015) 


(a) The Contractor shall provide written notification immediately to the Contracting Officer of any action, including 
any proceeding before an administrative agency, filed against the Contractor arising out of the performance of this 
contract, including, but not limited to the performance of any subcontract hereunder; and any claim against the 
Contractor the cost and expense of which is allowable under the clause entitled “Allowable Cost and Payment.” 


(b) Except as otherwise directed by the Contracting Officer, the Contractor shall furnish immediately to the 
Contracting Officer copies of all pertinent documents received by the Contractor with respect to such action or 
claiin. To the extent not in conflict with any applicable policy of insurance, the Contractor may, with the Contracting 
Officer’s approval, settle any such action or claim. If required by the Contracting Officer, the Contractor shail effect 
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an assignment and subrogation in favor of the Government of all the Contractor’s rights and claims (except those 
against the Government) arising out of any such action or claim against the Contractor; and authorize representatives 
of the Government to settle or defend any such action or claim and to represent the Contractor in, or to take charge 
of, any action. 


(c) If the Government undertakes a settlement or defense of an action or claim, the Contractor shall furnish all 
reasonable assistance in effecting a settlement or asserting a defense. Where an action against the Contractor is not 
covered by a policy of insurance, the Contractor shall, with the approval of the Contracting Officer, proceed with the 
defense of the action in good faith. The Government shall not be liable for the expense of defending any action or 
for any costs resulting from the loss thereof to the extent that the Contractor would have been compensated by 
insurance which was required by other terms or conditions of this contract, by law or regulation, or by written 
direction of the Contracting Officer, but which the Contractor failed to secure through its own fault or negligence. In 
any event, unless otherwise expressly provided in this contract, the Government shall not reimburse or indemnify 
the Contractor for any liability loss, cost, or expense, which the Contractor may incur or be subject to by reason of 
any loss, injury or damage, to the person or to real or personal property of any third parties as may accrue during, or 
arise from, the performance of this contract. 


(End of clause) 
352.237-75 Key Personnei. (Dec 2015) 


The key personnel specified in this contract are considered to be essential to work performance. At least 30 days 
prior to the contractor voluntarily diverting any of the specified individuals to other programs or contracts the 
Contractor shall notify the Contracting Officer and shall submit a justification for the diversion or replacement and a 
request to replace the individual. The request must identify the proposed replacement and provide an explanation of 
how the replacement's skills, experience, and credentials meet or exceed the requirements of the contract (including, 
when applicable, Human Subjects Testing requirements). If the employee of the contractor is terminated for cause or 
separates from the contractor voluntarily with less than thirty days notice, the Contractor shall provide the maximum 
notice practicable under the circumstances. The Contractor shall not divert, replace, or announce any such change to 
key personnel without the written consent of the Contracting Officer, The contract will be modified to add or delete 
key personnel as necessary to reflect the agreement of the parties. 


(End of clause) 


CDC AGO001 — Invoice Submission (Jul 2017) 

(a) The Contractor shall submit the original contract invoice/voucher to the address shown below: 
The Centers for Disease Control and Prevention Office of Financial Resources (OFR) 

P.O. Box 15580 

Atlanta, GA 30333 

Or — The Contractor may submit the original invoice via facsimile or email: 

Fax: 404-638-5324 

Email: FMOAPINV@CDC.GOV 


NOTE: Submit to only one (1) of the above locations. 


(b) The contractor shall submit 2 copies of the invoice to the cognizant contracting office previously identified in 
this contract. These invoice copies shali be addressed to the attention of the Contracting Officer. 


ic) The Contractor is , is not required to submit a copy of each invoice directly to the Contracting Officer's 
Representative (COR) concurrently with submission to the Contracting Officer. 


{d} In accordance with 5 CFR part 1315 (Prompt Payment), CDC's Office of Financial Resources is the designated 
billing office for the purpose of determining the payment due date under FAR 32.904. 
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(e) The Contractor shall include (as a minimum) the following information on each invoice: 


(1) Contractor’s Name & Address 

(2) Contractor’s Tax Identification Number (TIN} 

(3) Purchase Order/Contract Number and Task Order Number, as appropriate 
(4) Invoice Number 

(5) Invoice Date 

(6) Contract Line Item Number (CLIN) and Description of Item 

(7) Qnantity 

(8) Unit Price & Extended Amount for each line item 

(9) Shipping and Payment Terms 

(10) Total Amount of Invoice 

(11) Name, title and telephone number of person to be notified in the event of a defective invoice 
(12) Payment Address, if different from the information in K1). 

{13) DUNS + 4 Number 

(14) Electronic funds transfer (EFT) banking information 


{End of Clause} 


Payment by Electronic Funds Transfer (Dec 2005) 


(a) The Government shall use electronic funds transfer to the maximum extent possible when making payments 
under this contract. FAR 52.232-33, Payment by Electronic Funds Transfer — Central Contractor Registration, in 
Section [, requires the contractor to designate in writing a financial institution for receipt of electronic funds transfer 
payments 


(b) In addition to Central Contractor Registration, the contractor shall make the designation by submitting the form 
titled “ACH Vendor/Miscellaneous Payment Enrollment Form” to the address indicated below. Note: The form is 
either attached to this contract (see Section J, List of Attachments) or may be obtained by contacting the Contracting 
Officer or the CDC Financial Management Office at (404) 498-4050. 


(c) In cases where the contractor has previously provided such designation, i.e., pursuant to a prior contract/order, 
and been enrolled in the program, the form is not required unless the designated financial institution has changed. 


(d) The completed form shall be mailed after award, but no later than 14 calendar days before an invoice is 
submitted, to the following address: 


The Centers for Disease Control and Prevention 
Financial Management Office (FMO) 

P.O. Box 15580 

Atlanta, GA 30333 

Or — Fax copy to: 404-638-5324 


(End of Clause} 
508 Standard Requirements 
All electronic and information technology (EIT) procured through this order must ineet the applicable accessibility 
standards at 36 CFR 1194.22, unless an agency exception to this requirement exists. 36 CFR 1194 implements 


Section 508 of the Rehabilitation Act of 1973, as amended, and is viewable at http://www.access- 
board.gov/sec508/508 standards, htm - Section 1194.22. 
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The contractor shall indicate for each line item in the schedule whether each product or service is compliant or non- 
compliant with the accessibility standards at 36 CFR 1194.22. Further, the quote must indicate where ful] details of 
compliance can be found (i.e., vendor’s website or other exact location). 


{End of Clause) 
352.211-3 Paperwork Reduction Act. 


(a) This contract involves a requirement to collect or record information calling either for answers to identical 
questions from 10 or more persons other than Federal employees, or information from Federal employees which is 
outside the scope of their employment, for use by the Federal government or disclosure to third parties; therefore, 
the Paperwork Reduction Act of 1995 (44 U.S.C. 3501 et seq.) shall apply to this contract. No plan, questionnaire, 
interview guide or other similar device for collecting information (whether repetitive or single time) may be used 
without the Office of Management and Budget (OMB) first providing clearance. Contractors and the Contracting 
Officer's Representative shall be guided by the provisions of 5 CFR part 1320, Controlling Paperwork Burdens on 
the Public, and seek the advice of the HHS operating division or Office of the Secretary Reports Clearance Officer 
to determine the procedures for acquiring OMB clearance. 


(b} The Contractor shall not expend any funds or begin any data collection until the Contracting Officer provides the 
Contractor with written notification authorizing the expenditure of funds and the collection of data. The Contractor 
shall allow at least 120 days for OMB clearance. The Contracting Officer will consider excessive delays caused by 
the Government which arise out of causes beyond the control and without the fault or negligence of the Contractor 
in accordance with the Excusable Delays or Default clause of this contract. 


(End of clause) 
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EXHIBIT I 
Centers for Disease Control and Prevention (CDC) 
Contractor Non-Disclosure Agreement 


I. Non-public Information 


[Name of contractor] understands that in order to fulfill the responsibilities pursuant to [Contract name and 
number] between the Centers for Disease Control and Prevention and [Name of CDC contractor] dated [date], 
employees of [contractor] will have access to non-public information, including confidential and privileged 
information contained in government-owned information technology systems. For purposes of this agreement, 
confidential information means government information that is not or will not be generally available to the public. 


In order to properly safeguard non-public information, [contractor] agrees to ensure that prior to being granted 
access to government information or the commencement of work for the CDC, whichever is applicable, all 
employees will sign a Non-Disclosure Agreement (NDA) provided by the CDC prior to beginning work for the 
CDC. Contractor agrees to submit to the contracting official the original signed copies of NDAs signed by the 
contractor’s employees in accordance with the instructions provided by the contracting official. Failure to provide 
signed NDAs in accordance with this agreement and instructions provided by the contracting official could delay or 
prevent the employee from commencing or continuing work at the CDC until such agreement is signed and returned 
to the contracting official. 


Contractor further agrees that it will not cause or encourage any employee to disclose, publish, divulge, release, or 
make known in any manner or to any extent, to any individual other than an authorized Government employee any 
non-public information that the employee may obtain in connection with the performance of the employee’s 
responsibilities to the CDC. 


H. Procurement-Sensitive Information 


Contractor further agrees that it will not cause or encourage any employee to disclose, publish, divulge, release, or 
make known in any manner or to any extent, to any individual, other than an authorized Government employee, any 
procurement-sensitive information gained while in connection with fulfilling the employee’s responsibilities at the 
CDC. For purposes of this agreement, procurement-sensitive information includes, but is not limited to, all 
information in Statements of Work (SOW), Requests for Contract (RFC), and Requests for Proposal (RFP); 
Responses to RFPs, including questions from potential Offerors; non-public information regarding procurements; all 
documents, conversations, discussions, data, correspondence, electronic mail (e-mail), presentations, or any other 
written or verbal communications relating to, concerning, or affecting proposed or pending solicitations or awards; 
procurement data; contract information plans; strategies; source selection information and documentation; offerors’ 
identities; technical and cost data: the identity of government personal involved in the solicitation; the schedule of 
key technical and procurement events in the award determination process; and any other information that may 
provide an unfair competitive advantage to a contractor or potential contractor if improperly disclosed to them, or 
any of their employees. 


Contractor understands and agrees that employee access to any procurement-sensitive information may create a 
conflict of interest which will preclude contractor from becoming a competitor for any acquisition(s) resulting from 
this information. Therefore, if an employee participates in any discussions relating to procurement-sensitive 
information, assists in developing any procurement-sensitive information, or otherwise obtains any procurement- 
sensitive information during the course of performing duties at the CDC, contractor understands and agrees that 
contractor may be excluded from competing for any acquisition(s) resulting from this information. 


il. Identification of Non-Government Employees 
Contractor understands that its employees are not agents of the Government. Therefore, unless otherwise directed in 


writing by the CDC, contractor agrees to assist and monitor employee compliance with the following identification 
procedures: 


A. 


E. 


47QTCK18D0003 75D30120F09621 
Page 44 of 47 


At the beginning of interactions with CDC employees, employees of other governmental entities, 
members of the public, or the media (when such communication or interaction relates to the 
contractor’s work with the CDC), contractors’ employees will identify themselves as an employee 
of a contractor. 

Contractors’ employees will include the following disclosures in all written communications, 
including outgoing electronic mail (e-mail) messages, in connection with contractual duties to the 
cbc: 

Employee's name 

Name of contractor 

Center or office affiliation 

Centers for Disease Control and Prevention 

At the beginning of telephone conversations or conference calls, contractors’ employees will 
identify themselves as an employee of a contractor. 

Contractors should not wear any CDC logo on clothing, except for a CDC issued security badge 
while carrying out work for CDC or on CDC premises. The only other exception is when a CDC 
management official has granted permission to use the CDC logo. 

Contractors’ employees will program CDC voice mail message to identify themselves as an 
employee of a contractor. 


I understand that federal laws including, 18 U.S.C. 641 and 18 U.S.C. 2071, provide criminal penalties for, among 
other things, unlawfully removing, destroying or converting to personal use, or use of another, any public records. 
Contractor acknowledges that contractor has read and fully understands this agreement. 


Name of contractor: 


Signature of Authorized Representative of Contractor: 


Date: 


Copies retained by: contracting official and contractor 
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EXHIBIT II 
Centers for Disease Control and Prevention (CDC) 
Contractors’ Employee Non-Disclosure Agreement 


I. Non-Public Information 


I understand that in order to fulfill my responsibilities as an employee of [Name of CDC contractor], I will have 
access to non-public information, including confidential and privileged information contained in government-owned 
information technology systems. For purposes of this agreement, confidential information means governinent 
information that is not or will not be generally available to the public. Privileged information means information 


I [Name of Employee], agree to use non-public information only in performance of my responsibilities to the CDC. 
I agree further that I will not disclose, publish, divulge, release, or make known in any manner or to any extent, to 
any individual other than an authorized Government employee, any non-public information that I may obtain in 
connection with the performance of my responsibilities to the CDC. 


II. Procurement-Sensitive Information 


I further agree that unless I have prior written permnission from the CDC, I will not disclose, publish, divulge, 
release, or make known in any manner or to any extent, to any individual other than an authorized Government 
employee, any procurement-sensitive information gained in connection with the performance of my responsibilities 
to the CDC. I specifically agree not to disclose any non-public, procurement-sensitive information to employees of 
my company or any other organization unless so authorized in writing by the CDC. For purposes of this agreement, 
procurement-sensitive information inciudes, but is not limited to, ali information in Statements of Work (SOW), 
Requests for Contract (RFC), and Requests for Proposal (RFP); Responses to RFPs, including questions from 
potential Offerors; non-public information regarding procurements; all documents, conversations, discussions, data, 
correspondence, electronic mail (e-mail), presentations, or any other written or verbal communications relating to, 
concerning, or affecting proposed or pending solicitations or awards; procurement data; contract information plans; 
strategies; source selection information and documentation; offerors’ identities; technical and cost data; the identity 
of government personal involved in the acquisition; the schedule of key technical and procurement events in the 
award determination process; and any other information that may provide an unfair competitive advantage to a 
contractor or potential contractor if improperly disclosed to them, or any of their employees. 


I understand and agree that my access to any procurement-sensitive information may create a conflict of interest 
which will preclude me, my current employer, or a future empioyer from becoming a competitor for any resulting 
government acquisition derived from this information. Therefore, if I participate in any discussions relating to 
procurement-sensitive information, assist in developing any procurement-sensitive information, or otherwise obtain 
any procurement-sensitive information during the course of performing my duties at the CDC, I understand and 
agree that I, my current employer, and any future employer(s) may be excluded from competing for any resulting 
acquisitions. 


III. Special Non-Disclosure Clause for Contractors with Access to CDC Grants Management and 
Procurement-Related Information Technology Systems 


In addition to complying with the non-disclosure requirements and safeguards stated above, I understand that my 
authorization to use CDC’s grants management and procurement systems is strictly limited to the access and 
functions necessary for the performance of my responsibilities to the CDC and which have been approved in 
advance by the CDC. | understand that I am not authorized to enter procurement requests for any requirements 
pertaining to contracts or subcontracts held by me or my employer. 


IV. Identification as a Non-Government Employee 


I understand that as an employee of a government contractor, I represent an independent organization and I am not 
an agent of the Government. Therefore, I agree that unless I have prior written authorization from the CDC, I will, at 
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the beginning of interactions with CDC employees, employees of other governmental entities, members of the 
public, or the media (when such communication or interaction relates to the contractor's work with the CDC), 
identify myself as an employee of a contractor. | further agree to use the following identification procedures in 
connection with my work at the CDC: 


A. I will include the following disclosures in all written communications, including outgoing electronic mail (e- 
mail) messages: 


Employee's name 

Name of contractor 

Center or office Affiliation 

Centers for Disease Control and Prevention 


B. I will identify myself as an employee of a contractor at the beginning of telephone conversations or conference 
calls; 

C. I will not wear any CDC logo on clothing, except for a CDC issued security badge while carrying out work for 
CDC or on CDC premises; the only other exception is when a CDC management official has granted permission to 
use the CDC logo. 

D. I will program my CDC voice mail message to identify myself as a contractors’ employee. 

I understand that federal laws including, 18 U.S.C. 641 and 18 U.S.C. 2071, provide criminal penalties for, among 
other things, unlawfully removing, destroying or converting to personal use, or use of another, any public records. I 
acknowledge that I have read and fully understand this agreement. 

Name of contractor: 

Name of Employee: 

Signature of Employee: 


Date: 


Copies retained by: contracting official, contractor, and Employee 
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CLAUSES 
§2.227-14 Rights in Data-General.(May 2014} 
(a) Definitions. As used in this clause- 


Computer database or “database means” a collection of recorded information in a form capable of, and for the 
purpose of, being stored in, processed, and operated on by a computer. The term does not include computer 
sofiware. 


Computer software- 
(1} Means 


(i} Computer programs that comprise a series of instructions, rules, routines, or statements, regardless of 
the media in which recorded, that allow or cause a computer to perform a specific operation or series of 
operations: and 


ti} Recorded information comprising source code listings, design details, algorithms, processes, flow 
charts, formulas, and related material that would enable the computer program to be produced, created, or 
compiled. 


(2) Does not include computer databases or computer software documentation. 


Computer software documentation means owner's manuals, user's manuals, installation instructions, 
operating instructions, and other similar items, regardless of storage medium, that explain the capabilities of 
the computer software or provide instructions for using the software. 


Data means recorded information, regardless of form or the media on which it may be recorded. The term 
includes technical data and computer software. The term docs not include information incidental to contract 
administration, such as financial, administrative, cost or pricing, or management information. 


Form, fit, and function data means data relating to items, components, or processes that are sufficient to 
enable physical and functional interchangeability. and data identifying source, size. configuration, mating, 
and attachment characteristics, functional characteristics, and performance requirements. For computer 
software it means data identifying source, functional characteristics, and performance requirements but 
specifically excludes the source code, aigorithms, processes, formulas, and flow charts of the software. 


Limited rights means the rights of the Government in limited rights data as set forth in the Limited Rights 
Notice of paragraph (2)(3) if included in this clause. 


Limited rights data means data, other than computer software, that embody trade secrets or are commercial 
or financial and confidential or privileged, to the extent that such data pertain to items, components, or 
processes developed at private expense, including minor modifications. 


Restricted computer software means computer software developed at private expense and that is a trade 
secret, is coinmercial or financial and confidential or privileged, or is copyrighted computer software, 
including minor modifications of the computer software. 


Restricted rights, as used in this clause, means the rights of the Government in restricted computer software, 
as set forth in a Restricted Rights Notice of paragraph (g) if included in this clause, or as otherwise may be 
provided in a collateral agreement incorporated in and made part of this contract, including minor 
modifications of such computer software. 


Technical data means recorded information (regardless of the form or method of the recording) of a 
scientific or technical nature (including computer databases and computer software documentation). This 
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term does not include computer software or financial, administrative, cost or pricing, or management data or 
other information incidental to contract administration. The term includes recorded information of a 
scientific or technical nature that is included in computer databases (See 41 U.S.C. 116). 


Unlimited rights means the rights of the Government to use, disclose, reproduce, prepare derivative works, 
distribute copies to the public, and perfonn publicly and display publicly, in any manner and for any 
purpose, and to have or permit others to do so. 


b; Allocation of rights. 
g 
(1) Except as provided in paragraph (c) of this clause, the Government shall have unlimited rights in- 
(i) Data first produced in the performance of this contract: 
{ii} Form, Ot, and function data delivered under this contract; 
(ii) Data delivered under this contract (except for restricted computer software) that constitute manuals or 
instructional and training material for installation, operation, or routine maintenance and repair of items, 


components, or processes delivered or furnished for use under this contract; and 


(iv) All other data delivered under this contract unless provided otherwise for limited rights data or 
restricted computer software in accordance with paragraph (9} of this clause. 


(2} The Contractor shall have the right t0- 


G) Assert copyright in data first produced in the performance of this contract to the extent provided in 
paragraph (c)(1) of this clause; 


(ii} Use, release to others, reproduce, distribute, or publish any data first produced or specifically used by 
the Contractor in the performance of this contract, unless provided otherwise in paragraph {d} of this 
clause; 


(iii) Substantiate ihe use ol, add, or correct limited rights, restricted rights, or copyright notices and to take 
other appropriate action, in accordance with paragraphs {e) and (f) of this clause; and 


(iv) Protect from unauthorized disclosure and use those data that are limited rights data or restricted 
computer software to the extent provided in paragraph {g} of this clause. 


{c} Copyright- 
{1} Data first produced in the performance of this contract. 


(i) Unless provided otherwise in paragraph (d) of this elause, the Contractor may, without prior approval of 
ihe Contracting Officer, assert copyright in scientific and technical articles based on or containing data first 
produced in the performance of this contract and published in academic, technical or professional jouruals, 
symposia proceedings, or similar works. The prior, express written permission of the Contracting Officer is 
required to assert copyright in all other data first produced in the performance of this contract. 


GÐ When authorized to assert copyright to the data, the Contractor shall affix the appficable copyright 
notices of 17 U.S.C. 401 or 402, and an acknowledgment of Government sponsorship (including contract 
number). 


tiid For data other than computer software, the Contractor grants to the Government, and others acting on 
its behalf, a paid-up, nonexclusive, irrevocable, worldwide license in such copyrighted data to reproduce. 
prepare derivalive works, distribute copies to the public, and perform publicly and display publicly by or on 
behalf of the Government. For computer software, ihe Contractor grants to the Government, and others 
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acting on its behalf, a paid-up, nonexclusive, irrevocable, worldwide license in such copyrighted computer 
software to reproduce, prepare derivative works, and perform publicly and display publicly (but not to 
distribute copies to the public) by or on bchalf of the Government. 


(2) Data not first produced in the performance of this contract. The Contractor shall not, without the prior 
written permission of the Contracting Officer, incorporate in data delivered under this contract any data not first 
produced in the performance of this contract unless the Contractor- 


{Ð Identifies the data; and 


(u} Grants to the Government, or acquires on its behalf, a license of the same scope as set forth in 
paragraph (c)(1) of this clause or, if such data are restricted computer software, the Government shall 
acquire a copyright license as set forth in paragraph (g)(4) of this clause (if included in this contract) or as 
otherwise provided in a collateral agreement incorporated in or made part of this contract. 


(3) Removal of copyright notices. The Government will not remove any authorized copyright notices placed on 
data pursuant to this paragraph (c), and will include such notices on alt reproductions of the data. 


(d} Release. publication, and use of data. The Contractor shall have the right to use, release to others, reproduce, 
distribute, or publish any data first produced or speciftcally used by the Contractor in the performance of this 
contract, except- 


(1) As prohibited by Federal law or regulation (e.g., export control or national security laws or regulations): 
{2} As expressly set forth in this contract; or 


(3) Ifthe Contractor receives or is given access to data necessary for the performance of this contract that 
contain restrictive markings, the Contractor shail treat the data in accordance with such markings umtess 
specifically authorized otherwise in writing by the Contracting Officer. 


(e) Unauthorized marking of data. 


{1} Notwithstanding any other provisions of this contract concerning inspection or acceptance, if any data 
delivered under this contract are marked with the notices specified in paragraph (@}(3) or (g) (4) if included in 
this clause, and use of the notices is not authorized by this clause, or if the data bears any other restrictive or 
limiting markings not authorized by this contract, the Contracting Officer may at any time either return the data 
to the Contractor, or cancel or tenore the markings. Itowever, pursuant to 4] U.S.C. 4703, the following 
procedures shall apply prior to canceling or ignoring the markings. 


(i) The Contracting Officer will make written inquiry to the Contractor affording the Contractor 60 days 
from receipt of the inquiry to provide written justification to substantiate the propriety of the markings; 


(ii} If the Contractor faifs to respond or fails to provide written justification to substantiate the propriety of 
the markings within the 60-day period (or a longer time approved in writing by the Contracting Officer for 
good cause shown), the Government shall have the right to cancel or ignore the markings at any time after 

said period and the daia will no longer be made subject to any disclosure prohibitions. 


(iti) Ifike Contractor provides written justification to substantiate the propriety of the markings within the 
period set in paragraph (e)(1)(i} of this clause, the Contracting Officer will cunsider such written 
justification and determine whether or not the markings are to he cancelled or ignored. If the Contacting 
Officer determines that the markings are authorized, the Contractor will be so notified in writing. 1f the 
Contracting Officer determines, with concurrence of the head of the contracting activity, that the markings 
are not authorized, the Contracting Officer will furnish the Contractor a written determination, which 
determination will become the final agency decision regarding the appropriateness of the markings unless 
the Contractor files suit in a court of competent jurisdiction within 90 days of reccipt of the Contracting 
Officer's decision. The Government will continue to abide by the markings under this paragraph (¢)(1)(iii} 
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unti} final resolution of the matter either by the Contracting Officer's determination becoming final (in 
which instance the Government will thereafter have the right to cancel or ignore the markings at any time 
and the data will no longer be made subject to any disclosure prohibitions), or by final disposition of the 
matter by court decision if suit is filed, 
(2) The time limits in the procedures set forth in paragraph (e)(1) of this clause may be modified in accordance 
with agency regulations implementing the Freedom of Information Act (5 U.S.C. 552) if necessary to respond 
to a request thereunder. 

(3) Except to the extent the Government’s action occurs as the result of final disposition of the matter by a 
court of competent jurisdiction, the Contractor is not prochuded by paragraph {e} of the clause from bringing a 
claim, in accordance with the Disputes clause of this contract, that may arise as the result of the Governmem 
removing or ignoring authorized markings on data delivered under this contract. 


(Ð) Omitted or incorrect markings. 


(D Data delivered to the Government without any restrictive markings shall be deemed to have been furnished 
with unlimited rights. The Government is not liable for the disclosure, use, or reproduction of such data. 


(2) Ifthe unmarked data has not been disclosed without restriction outside the Government, the Contractor may 
request, within 6 months {or a longer time approved by the Contracting Officer in writing for good cause 
shown) after delivery of the data. permission to have authorized notices placed on the data at the Contractor's 
expense. The Contracting Officer may agree to do so if the Contractor- 

(i) Identifies the data to which the omitted notice is to be applied; 

Gi) Demonstrates that the omission of the notice was inadvertent; 


Gti) Establishes that the proposed notice is authorized; and 


(iv) Acknowledges that the Governmcat has no liability for the disclosure, usc, or reproduction of any 
data made prior to the addition of the notice or resulting from the omission of the notice. 


(3) Tf data has been marked with an incorrect notice, the Contracting Officer may- 


{i) Permit correction of the notice at the Coniractor’s expense if the Contractor identifies the data and 
demonstrates that the correct notice is authorized; or 


Gi} Correct any incorrect notices. 
{g} Protection of limited rights data and restricted computer software, 
(1) The Contractor may withhold from delivery qualifying limited rights data or restricted compoter software 
that are not data identified in paragraphs (bX (i), {ii}, and (iii) of this clause. As a condition to this 
withholding, the Contractor shall- 
(i) [dentify the data being withheld; and 


(ii) Furnish form, fit, and function data instead. 


(2) Limited rights data that are formatted as a computer database for delivery to the Government shall be 
treaied as limited rights data and not restricted computer software. 


(3) [Reserved] 
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{h} Subcontracting. The Contractor shall obtain from its subcontractors all data and rights therein necessary to fulfill 
the Contractor’s obligations to the Government under this contract, If a subcontractor refuses to accept terms 
affording the Government those rights, the Contractor shall promptly notify the Contracting Officer of the refusal 
and shail not proceed with the subcontract award without authorization in writing from the Contracting Officer. 


G) Relationship to patents or other rights. Nothing contained in this clause shall imply a license to the Government 
under any patent or be construed as affecting the scope of any license or other right otherwise granted to the 
Government. 


(End of clause} 
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the Government’s preference (e.g., electronic (online) reports over paper/non-standard reports, serious adverse events over non-serious 
adverse events, domestic reports over foreign reports), Additional information can he found in the revised section of the PWS on page 13 
of this modification. 


Except as provided herein, all terms and conditions of the document referenced in Item 9A or 10A, as heretofore changed, remains unchanged and in full force and effect. 
15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME OF CONTRACTING abe wet A "i 
igitally signed by 


Philip Denis prip Denis- 


15B. CONTRACTOR/OFFEROR 15C. DATE SIGNED ei STATES OF AMERICA ~ Date: 202 1.2. PATE SIGNED 
(X4) 19 February 2021 | BY 2 16:45:29 -05'00' 
(Signature of person authorized to sign) (Signature of Contracting Officer) 
NSN 7540-01-152-8070 STANDARD FORM 30 (REV, 10-83) 
PREVIOUS EDITION UNUSABLE 30-105 Prescribed by GSA 


FAR (48 CFR) 53.243 
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SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS 


Option Period Items: Period of Performance: 08/27/2020 — 08/26/2022 


ITEM 
VAERS SARS-CoV-2 
The contractor shall provide CDC and 
FDA technical and programmatic support 
to collect and analyze information on 
vaccine adverse events (VAEs), and 
facilitate reporting to VAERSspecifically 
pertaining to SARS-Co¥-2. Reference the 
SOW and all associated deliverables. 


This is a T&M, severable line item. 


PoP: 08/27/2020 — 08/26/2022 


0002 TraveVODCs 
All travel must be in accordance with the 
Federal Travel Regulations (FTR). The 
Contractor shall obtain COR pre-approval 
of estimated travel expenses prior to 


travel occurrence. Charges will be 
submitted for actual costs incurred. The 
contractor shall ensure that the requested 
travel costs will not exceed the amount 
authorized in this task order. 


Other direct costs include travel and 
training requirements. All other direct 
costs must be pre-approved by the COR 
prior to occurrence. 


T&M, severable line item 


PoP: 08/27/2020 — 08/26/2022 


0003 Contract Access Fee 
The Contract Access Fee (CAF) is 0.75% 
to be applied to the total price for 
contractor performance as billed to the 
government on each Task Order, The 
CAF is paid by the Ordering Agency, but 
remitted to GSA by the Contractor. Based 
on the established CAF rate, the 
Contractor shall include the CAF in each 
proposal. The Contractor shall include the 
CAF as a separate cost element per year 
on all quotes to the government, 
regardless of contract type. The CAF 
shall never be treated as a negotiable 
element between the Contractor and the 
Ordering Agency. The CAF Rate, 
effective at time of the Task Order award, 
shall remain the same for that Task Order 
for the full term of the Order. 

PoP: 08/27/2020 — 08/26/2022 
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SECTION C — PERFORMANCE WORK STATEMENT (PWS) 


Changes to the PWS are noted in YELLOW highlighted section on page 13 of this 


modification. 


STATEMENT OF WORK FOR 
VACCINE ADVERSE EVENT REPORTING SYSTEM (VAERS) 
FOR SARS-COV-2 VACCINES 


I. BACKGROUND: 

The Vaccine Adverse Event Reporting System (VAERS) is a mandated program sponsored jointly by the Centers 
for Disease Control and Prevention (CDC) and the US Food and Drug Administration (FDA). The purpose of this 
project as authorized by the National Childhood Vaccine Injury Act (NCVIA}, P.L. 99-660, is to provide a single 
nationwide mechanism to report, analyze and monitor vaccine adverse events (VAEs) that occur after receipt of 
vaccines. It also provides a vehicle for disseminating vaccine safety information to vaccines, family members, health 
care providers, vaccine manufacturers, government agencies, and other partners. 


Vaccines represent one of the most cost-effective means of reducing or eliminating morbidity and mortality from 
selected infectious diseases. However, no vaccine is completely effective or safe. Recommendations for the use of 
vaccines are based on careful weighing of benefits of vaccination and risks of both the disease being vaccinated 
against and the immunization itself. Vaccines currently in routine use have been determined by various expert 
groups and FDA to have benefits that outweigh their risks. As part of any vaccination program, ongoing monitoring 
is essential to ensure that new or rare VAEs are recognized and appropriate measures taken. Vaccines undergo 
safety and efficacy testing in the laboratory and in controlled clinical studies before licensure or authorization (in the 
case of Emergency Use Authorization). Because these trials are limited in size, duration, and heterogeneity, rare, 
delayed, or unusual events caused by a vaccine may not be detected. Once a vaccine is used in the general 
population, post marketing surveillance is necessary to evaluate such VAEs. 


To meet each agency’s needs for vaccine safety monitoring data, CDC and FDA have jointly sponsored VAERS 
since 1990. The needs relate to CDC’s public health responsibility for developing and issuing national vaccine 
policy recommendations and FDA’s responsibility for licensing and regulating vaccines. 


VAERS contains reports of VAEs based on two criteria, mandated and voluntary reports. The events mandated for 
healthcare provider and vaccine manufacturer reporting are listed in the Reportable Adverse Events Table (RET) 
available at https://vaers.hhs.gov/docs/VAERS Table of Reportable Events Following Vaccination.pdf US- 
manufacturers of vaccines are mandated by 21 CFR Part 600.80 (Attachment 3) to submit reports routinely on a 
periodic basis, as well as in an expedited manner for more serious events. In addition, healthcare providers are 
encouraged to report all other clinically significant VAEs following the administration of any US vaccine in all age 
groups. For all reports, the impetus for reporting is not a presumed causal relationship between the vaccination and 
the event but may be based simply on the occurrence of the event temporally following vaccination and the lack of 
other obvious causes, 


From 2014 through 2018, VAERS received an annual average of 53,000 reports, of which 45,500 were US reports. . 
Of the US reports, 5.0% were classified as serious (i.¢., associated with disability, hospitalization, prolongation of 
existing hospitalization, life-threatening illness, congenital anomaly/birth defect, or death [21 CFR 600.80]}. Since 
1990, VAERS has received over 740,000 reports, most of which describe mild and self-limited adverse events such 
as injection site reactions and fever. (VAERS government data archive January 18, 2019.) VAERS helps to identify 
important new safety concems and thereby can help inform vaccine policymakers and healthcare providers. In 
addition, the data are valuable for regulatory actions and vaccine research studies. The US Government considers 
post-licensure/authorization surveillance for any licensed and new vaccines through VAERS to be a nationally 
critical function, and the US Government considers the requirements of the VAERS activity to constitute essential 
services for which any lapse in coverage of services would be unacceptable. 


The current COVID-19 pandemic and the anticipated COVID-19 vaccination program has created additional 
requirements for VAERS. Unanticipated project needs have materialized, requiring efforts beyond routine VAERS 
functions. Task requirements in support of public health emergencies (e.g., pandemic influenza, natural disasters 
and terrorist activities) and unanticipated federal mandates which are unpredictable necessitate an increase in 
Contractor staffing. These new requirements may result in increased workload for any of the tasks listed in the 
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of the Government as it relates to such events. Reasonable accommodations will be made to the Contractor by the 
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Government to address unforeseen events/circumstances and the Contractor will be allowed to negotiate the 
implementation of changes. 


IL OBJECTIVES: 

The Vaccine Adverse Event Reporting System (YVAERS) is the nation’s frontline system for detecting potential 
vaccine safety concerns after vaccines are licensed or authorized for use in the United States. It is a nationwide 
mechanism by which VAEs may be reported, analyzed, and made available to the public. It provides a vehicle for 
disseminating vaccine safety information to vaccines, family members, health care providers, vaccine 
manufacturers, government agencies, and other partners. VAERS is a collaboration between CDC and FDA. 


The purpose of this task order is to provide CDC and FDA technical and programmatic support to collect and 
analyze information on vaccine adverse events (Y AEs) after administration of SARS-CoV-2 vaccines and facilitate 
reporting to VAERS. The objectives of the VAERS Project are divided mto three categories: programmatic (mainly 
CDC), scientific (CDC and FDA), and regulatory (FDA). 


Programmatic Project Objectives: 
1. Create and maintain an online reporting website for VAEs following receipt of SARS-CoV-2 vaccines 


2. Implement an electronic submission gateway for manufacturers to submit VAE reports on SARS-CoV- 
2 vaccines 


3. Provide a reporting mechanism for VAEs that maintains submitted SARS-CoV-2 vaccines reports, 
including images of reports and medical documentation; 


4, Ensure data in the VAERS reports are accessible to the public as required by law (P.L. 99-660, Section 
2125), in accordance with policies to protect individuals’ privacy; 


5. Support CDC and FDA scientific staff in using VAERS data on VAEs after SARS-CoV-2 vaccines to 
rapidly respond to vaccine safety concerns or public health emergencies and in conducting 
epidemiologic and other scientific studies 


Scientific Project objectives: 
1. Rapidly detect new, unusual, or rare VAEs after SARS-Co¥-2 vaccines; 


2. Assess the safety of SARS-Co¥V-2 vaccines; or assess the safety in specific populations or situations 
where a new recommendation for SARS-CoV-2 vaccines occur; 


3. Rapidly identify vaccine lots for SARS-CoV-2 vaccines with increased numbers or types of reported 
adverse events (FDA lead); and 


4. Monitor trends in known VAEs after SARS-CoV-2 vaccines, particularly increases in reported VAEs 


Regulatory Project Objectives: 
1. Implement regulatory requirements related to VAERS, especially regarding reports from 


manufacturers after SARS-CoV-2 vaccines. [21 CFR 600.80). 


Tl. SCOPE OF WORK: 
The contractor shall provide support and technical assistance to CDC and FDA by supporting work in the following 
areas. The tasks below are not in order of priority. These tasks include: 


Administrative 

Report Receipt/Processing 

VAERS Foliow Up Activities and Enhanced Surveillance 
Quality Control for VAERS Data 

Information Management 


ee A 
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Current VAERS plans, protocols, procedures, manuals, standard operating procedures (SOPs), software, some 
hardware, etc. may be provided by the Government for adoption/modification (i.e., the contractor would not have to 
develop all entirely new products, but would have the option of rolling over/adopting/modifying existing ones). 
Additionally, scanning reports for the image database, certain manual data entry tasks, and other processes clearly 
related to paper reports shali only apply to paper reports (i.e., electronic reports do not require scanning and manual 
data entry, but may require redaction). 


IV. DESCRIPTION OF WORK: 

The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (VAE) reports 
after SARS-CoV-2 vaccines. The total number of reports received during periods of peak activity (which are not 
expected to reflect sustained activity) is expected to be 1,000 reports per day, with up to 40% of the reports serious 
in nature. 


TASK 1. ADMINISTRATIVE 
STANDARDIZED METHODS FOR PROVIDING OPERATIONAL SUPPORT FOR THE VAERS PROGRAM. 


A. The Contractor shall maintain Capability Maturity Model (CMM) Level 3 eertification (or equivalent) or 
higher throughout the performanee period of the contract and shall provide the Government current 
documentation of its CMM Level 3 (or equivalent) or higher certification, 


B. The Contractor shall have staff available for program operations, systems maintenance and consultation 
during normal business hours (8:30 AM Eastern to 5:00 PM Pacific) to accommodate all four time zones 
within the continental United States. The rationale for this requirement is that it is essential for VAERS to 
be fully operational and for staff to be available to conduct systems maintenance and recovery during both 
east and west coast business hours and to also provide a reasonable level of service for the Hawaii-Aleutian 
time zone, since VAERS is a national spontaneous surveillance system. 


C. The Contractor shall maintain a disaster recovery site for data management, data storage and all other 
VAERS data and IT functions that duplicates and replicates the primary production site and provides 
recovery of the production site within 24 hours (refer to Task 5: INFORMATION MANAGEMENT for 
capability requirements). This site shall be at least 100 miles away from the primary production site. The 
rationale for this requirement is that the disaster recovery site must be sufficiently distanced from the 
immediate area of the primary production site, but realistically within a business day's drive during an 
emergency. 


D. The Contractor shall provide hardware, software, office and communications equipment and other 
resources to be used for data receipt, processing, editing, analysis, reporting, transmission, and storage. 
The Contractor shall ensure systems compatibility with CDC and FDA software and hardware 
requirements. The Contractor shall ensure that applicable technology is capable of upgrade or provide for 
replacement with later technology if necessary. Hardware, software and equipment shall be maintained and 
upgraded in accordance with industry standards for IT and telecommunications equipment including 
routine maintenance, 


E. The Contractor shall upgrade VAERS program and related applications at the Government’s direction 
through official modification signed by the Contracting Officer (CO), based on requirements gathered from 
Government and other program stakeholders, using structured, phased software development methodology. 


F. The Contractor shall provide the Government with current and detailed system documentation. 
Documentation shall be maintained in two separate volumes: “Volume ] — VAERS Business Processes” 
and “Volume 2— VAERS IT Requirements and Design”. Requirements shall be maintained in a formal 
requirements database, to be prioritized by a change control board consisting of CDC, FDA and Contractor 
personnel. Work will be prioritized using this process, in both a routine and expedited manner as 
appropriate. The Contractor must demonstrate adherence to formal CMM Level 3 methodology as the 
standard for project performance. System documentation will be presented in standardized text format, 
gencrated in Microsoft Word document format (or other word processing format as specified by the 
Government), with all diagrams and other graphics contained as embedded objects with no external files or 
links, and presented in legible paper form or electronic form if requested by the Government. The 
Contractor shall provide detailed documentation of the technical procedures for data transport to the CDC 
and FDA, and documentation of technical details for source code and code relation, library dependencies, 
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and data transport mechanisms. The Contractor shall provide the Government with this dronmi 
within 30 days after contract award and annually or as requested thereafter, and new sections or 
documentation revisions will be provided to the Government upon implementation of changes in the 
system or procedures. 


G. The contractor shall communicate with CDC and FDA, any requested changes to the system (including, but 
not limited to database structure, and data processes) prior to implementation. Modifications/changes will 
not be performed until approval from CDC and FDA. 


H. The Contractor shall write standard operating procedures (SOPs) and modify them as needed. SOPs for all 
aspects of VAERS program operations, including complete VAERS report processing, shall be updated and 
provided to the Government annually or as requested. All SOPs shall be submitted to the Government for 
initial review and approval within 30 days after contract award and within 30 days of revision or 
implementation of changes, and minimally on an annual basis or as requested by the Government 
thereafter. SOPs shall be provided in a volume or series of volumes organized by subject, and will be 
presented in standardized text format, generated in Microsoft Word document format (or other word 
processing format as specified by the Government), with all diagrams and other graphics contained as 
embedded objects with no external files or links. 


|. The Contractor shall provide VAERS operations and system orientation for Government employees as 
necessary (minimum once per year). 


J. The Contractor shall produce and distribute the VAERS reporting form (Attachment A) and other forms as 
required for the operation of the VAERS program and reporting to VAERS. The VAERS program shall he 
identified as a Government program and the corporate name of the Contractor shall not be used on any 
form or correspondence to any entity other than CDC, FDA, or VICP, or used in any communication to 
represent the VAERS program unless approved hy the Government. 


K. The Contractor shall maintain lists of names, phone numbers, fax numbers, and 
E-mail addresses of contact personnel responsible for reporting from state health agencies, vaccine 
manufacturers, and immunization programs, limiting access and use to VAERS purposes only. The 
Contractor shall update this list on a quarterly basis and maintain this list for access by the Government in a 
manner specified by the Government. 


L. The contractor shall shred all incoming documents once they are permanently saved electronically. 


M. The Contractor shall establish, implement and maintain selected work groups as 
required by the Government throughout the life cycle of the contract, as needed and directed by the 
Government, and shall take and distribute minutes for working group meetings at the direction of the 
Government. 


TRANSITION OF CONTRACT SERVICES 
The Government considers VAERS an essential service; any lapse in coverage is considered unacceptable and can 
result in possible termination of contract. The Government requires a smooth and orderly transition of services. 


A. No later than 60 days after the contract award the Contractor shall have established a system of operations 
as described elsewhere in this SOW and perform a functional evaluation of the system. Furthermore, the 
Contractor shall be able to receive VAERS reports after SARS-CoV-2 vaccines via any of the means 
specified in this contract (including electronically submitted reports from manufactures (eVAERS) and 
public (website). The Contractor shall also be able to perform all activities involving the handling and 
processing of reports submitted to VAERS including report receipt, processing, data entry, coding, quality 
control, and report follow-up and verification. Contractor shall be able to provide data to the Government 
in the manners specified within this SOW, including the provision of data extracts, reports and report 
images, and meet this timeline development requirement as indicated for other activities and functions 
described within this SOW. 


B. No later than 60 days after contract award the VAERS system maintained by the Contractor shall be fully 
operational and shall meet the satisfaction of the Government as to operational functionality. 


C. No later than 60 days after contract award the Contractor shall meet all developmental and operational 
requirements in this SOW unless other specific timeline requirements for those requirements have been 
specified in the SOW. 
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D. No later than 60 days after contract award, the Contractor shall provide a Transition-Out Plan (end of 
performance period). The plan shall include a technical and management transition approach that is clear 
and complete and include a timeline and list of resources required for the transition. The Transition-Out 
Plan shall detail the planned transition methodology in logical sequence to ensure a smooth transition of all 
tasks and subtasks without interruption or decline in service quality. The plan shall also include a detailed 
description of risks (cost, technical, and performance) to both the Contractor and the Government, as well 
as risk mitigation strategies. Contractors shall also include all transition costs within their proposals. Please 
note that the continuity of services clause 52.237-3 is applicable and should be considered in developing 
the transition plan. 


All documents and materials developed by the Contractor for the fulfillment of this contract, including all SOPs, 
manuals, security plans, management plans and plans of operations, and hardware shall be considered the property 
of the Government and may be disposed of by the Government in any manner at the Government’s discretion. 


CHANGES TO INFORMATION MANAGEMENT PROCEDURES AND TASKS 


A. All tasks and activities specified in this SOW that pertain Information Management are subject to change, 
at the Government’s discretion, to accommodate and support fully electronic reporting to VAERS. 


B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated Information Management procedures and the Contractor 
will be allowed to negotiate implementation of changes within the scope via official modification. 


UNFORESEEN EVENTS/CIRCUMSTANCES 

Unanticipated project needs may materialize, requiring efforts beyond those described in this SOW. The 
Govemment may modify the contract to add task requirements (or enhance/expand current requirements) in support 
of public health emergencies (e.g. pandemic flu, natural disasters and terrorist activities) and unknown Federal 
mandates which are unpredictable and can initiate a workload surge, necessitating an increase in Contractor staffing. 
These new requirements may result in increased workload for any of the tasks listed in the SOW Tasks 1-5. 


A. Approval Process for Unforeseen Events and Circumstances 
CDC will provide the new work requirements and deliverables for cach of the optional support services to 
the Contracting Officer (CO) as a revision to the SOW. The CO will send the contractor the revised SOW 
containing the new requirements. The contractor will review the requirements and provide a technical and 
cost proposal with the appropriate labor categories, number of hours, and labor rates to the CO. A contract 
modification (SF30) must be awarded by the CO to add any new optional support requirement. The 
contractor must not work outside of the SOW without authorization from the CO. 


B. The Contractor shall be prepared to address unforeseen events/circumstances and meet the needs of the 
Government as it relates to any unforeseen events/circumstances. Reasonable accommodations will be 
made to the Contractor by the Government to address unforeseen events/circumstances and the Contractor 
will be allowed to negotiate the implementation of changes. 
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The implementation of activities to address unforeseen events/circumstances specified by the Government 
is dependent on the availability of core and supplemental funding to support such activities. 


Examples of unforeseen events/circumstances that have impacted VAERS operations include (1) changes 
in the IT certification and accreditation process, (2) changes in regulatory requirements for reporting VAEs 
and transmitting data to CDC and FDA, (3) introduction of new vaccines resulting in necessary coding and 
database architecture changes, (4) changes in reporting requirements, report processing procedures, and 
data availability timelines to meet current public health needs, (5) urgently needed IT capability during 
public health emergencies or in preparation for anticipated public health emergencies, and (6) hardware and 
software upgrades to accommodate unforeseen events/circumstances. This is not an exhaustive list and 
other unforeseen events/circumstances may occur throughout the course of the contract performance 
period. 


PROGRAM MANAGEMENT PLAN FOR CONTRACT ACTIVITIES 


A. 


The Contractor shall develop and maintain a Program Management Plan (PMP). The Contractor shall 
prepare and maintain a phased Program Management Plan describing the tasks, milestones, risk 
management strategy, organizational resources, performance measures and management contro] to be 
employed to meet the cost, performance requirements and schedule of each phase of the VAERS project. 
The plan shall define the Contractor’s governance process and include: 


1. The management structure of the Program Management Team, organizational! charts, key personnel 
and main points of contact, and identification of project teams and their roles and responsibilities. 


=) 


Identification of all partners, sub-contracts, sub-contractor management, criteria for selection of sub- 
contractors, and description of services to be performed by sub-contractors. The Contractor shall not 
sub-contract out more than 25% of the work described in this SOW (i.e., 75% of the work 
requirements described in this SOW must be completed by the prime Contractor), Sub-contracting out 
clinical services tasks, report processing and data entry, coding, report follow-up activities, core IT 
activities, quality assurance, and core business and administrative tasks is strongly discouraged and 
will be viewed unfavorably and result in possible termination of contract. 


3. Detailed mitigation response procedures in the event of unsatisfactory performance of program/project 
team members or sub-contractors. 


4. Specification of strategies to include detailed tirnelines with critical milestones to ensure that both 
long-term, strategic goals as well as specific, targeted objectives are met efficiently and effectively. 


5. The Contractor shall submit the PMP to the Governinent within 30 days after contract award and shall 
provide updates to the PMP annually or as requested by the Government. The PMP shall be in 
accordance with OMB Circular A-11, and the Federal IT Capital Programming Guide, Supplement to 
Part 7 of Circular No. A-11. Approval of the PMP by the Government shall be required. 


Key Project Personnel: The Contractor shall employ and retain competent, qualified personne] to perform 
services of this contract in an effective, prompt, accurate, courteous and efficient manner, The Contractor 
shall provide a plan for staffing key positions for this project, providing detail about the criteria and 
selection process used to fulfill the requirements of this contract, and shall notify CDC in the event of 
changes in staffing of key positions. Staffing of these key positions shall be subject to Government 
approval. The Contractor shall provide all necessary supervisory, project management, managerial, clinical, 
technical and administrative support to meet the planning, implementation, operational and management 
requirements of this contract. 


**NOTE FOR ALL TASKS 


Qualifications for personnel performing clinical activity (clinical staff} shall be subject to approval by the 
Goverment; the minimal education and experience qualifications for this activity shall be a nurse or other 
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clinical healthcare provider, with a minimum of 2 years of clinical or public health related experience. The 
manager of the follow-up activity shall be, at a minimum, an RN, PA, MD, DO or equivalent (e.g., MD 
from a foreign country who is not licensed to practice in the United States), The manager is required to 
have at least 2 years of clinical experience. The manager shall work closely with the Government to ensure 
that follow-up is conducted according to Government expectations, 


REPORTING REQUIRMENTS: 


A. PROGRAM MANAGEMENT MONTHLY STATUS REPORT - The contractor shall provide the 
Government with a monthly Program Management Monthly Status Report electronically to include the 
project’s cost, progress, and issues in a format as directed by the Government. A copy of each monthly 
report shall be sent to the COR, the CO, and the FDA Technical Representative. The contractor shall 
document in the report the efforts performed in the completion of each project task. The report shall be due 
on the 15th day of each month following the month reported upon. 


The Contractor shall propose format and data element recommendations for this report. The final format of 
the report shall be determined upon contract award. 


B. ANNUAL REPORT - On an annual basis, the Contractor shali provide a written report to the Government 
documenting significant work activities and accomplishments for the preceding 12-month period. This 
report shall provide a historical record of major work activities accomplished, those ongoing and those not 
accomplished for the reporting period. As an appendix to the annual report, the Contractor shall deliver to 
the Government the current database dictionaries, standard operating procedures, and user manuals. The 
annual report shall be delivered to the Government no later than 30 days following the specified reporting 
period. One report shall be sent to the COR, the CO, and the FDA Technical Representative. 


(6: DRAFT FINAL REPORT - The Contractor shall provide a draft final contract report no later than 
45 days prior to the expiration date of year 2 of this contract for review by the Government. The report 
shall include a written narrative highlighting major accomplishments under the contract. The report shall 
address each year of performance under the contract and document significant contractor findings, 
conclusions, recommendations, etc., to provide an objective review of contract activities. The Contractor 
shall provide copies of each draft final report electronically, and optional paper copies at the Government’s 
request. One report shall be sent to the COR, the CO, and the FDA Technical Representative. 


D. FINAL REPORT - Following review of the draft final report by the Government and receipt by the 
Contractor of the Government’s written comments, the contractor shall provide a final report on or before 
the expiration date of the contract. The Contractor shall provide copies of each final report electronically, 
and optional paper copies at the Government’s request. The report shall be sent to the COR, the CO, and 
the FDA Technical Representative. 


FORMAT OF DELIVERABLES 

Specific form format and additional content requirements of the delivery schedule items shall be coordinated 
between the Contractor and the Government, with a continued focus on providing useful and accurate reporting. 
The COR will provide the Contractor with disposal instructions for all technical documents (including, but not 
limited to all database dictionaries, databases, software, computer code, documentation, questionnaires, electronic 
files, etc.) in possession of the contractor at contract completion. 


TASK 2. REPORT RECEIPT/PROCESSING 
REPORTING TO THE VACCINE ADVERSE EVENT REPORTING SYSTEM (VAERS) AFTER SARS-CoV-2 
VACCINES 


The Contractor shall perform the following tasks/activities: 


A. Maintain communication protocols to provide assistance to the public for Vaecine Adverse Event 
Reporting System (VAERS) after SARS-CoV-2 vaccine-related questions. Communication protocols shall 


Cc. 
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involve appropriate telecommunication and electronic mechanisms for answering questions related to 
VAERS SARS-CoV-2 vaccine reporting and the VAERS system (e.g., how to obtain reporting forms, 
options for reporting, information referrals), and allowing for filing of VAERS reports over the phone in 
English or Spanish. The Contractor shall maintain communication protocols including, but not limited to: a 
toll-free telephone number and toll-free telefacsimile number to be listed as VAERS; a web site identified 
as VAERS, and an e-mail address (e-mail address may be specified by Government). The Contractor shall 
have staff available for consultation during normal! business hours (8:30 AM to 5:00 PM) that 
accommodate all four time zones within the continental United States (refer to Task 1: 
ADMINISTRATIVE for options for active time zone coverage during normal business hours in the 
continental United States). The Contractor shall implement, maintain, and upgrade as necessary, 
telecommunication and electronic reporting systems to be available 24 hours-per-day (the toll-free 
telephone number is answered by machine after business hours). After-hours automated support shall be 
available 24 hours-per-day through the web and fax. See Emergency Preparedness section for after-hours 
support details. Contractor staff shall respond to messages received at the VAERS telephone number and 
messages sent to the VAERS e-mail address within one business day of receipt. 


Staff the telephone system to provide telephone support for reporting during hours that accommodate 
normal business hours in the four time zones in the continental United States. The Contractor shall maintain 
a telephone voice message system, available at all times, which shall: 


1. Provide a mechanism for callers to contact VAERS toll-free by telephone; 


2. Provide coverage by automated menu choices for those times when Contractor staff does not 
immediately respond to calls to the telephone system; 


Ned 


Provide instructions to callers on ways to obtain the VAERS form and instructions on how to submit a 
VAERS report; 


4. Provide directions to find the VAERS website and to submit a VAERS report using the internet-based 
reporting form; 


5. Take messages at those times the telephone system is not actively staffed; 


6. Provide information on the National Vaccine Injury Compensation Program (VICP) (website 
information: www.hrsa.gov/vaccinecompensation); 


7. Provide additional information to callers as directed hy the Government. 


Maintain a United States Postal Service post office box identified as Vaccine Adverse Event Reporting 
System (VAERS) for SARS-CoV-2 vaccines and ensure, at a minimum, retrieval and logging of all mail 
from the post office box during each business day. 


Maintain VAERS for SARS-Co¥V-2 vaccine electronic internet-based reporting system, utilizing 
appropriate system security precautions. This includes reports submitted by VAERS users such as state 
health coordinators, immunization programs, other Federal Government agencies and programs, and other 
parties. The procedures shall include methods for receipt of reports via the Internet and shall allow for 
reporters to submit an initial VAERS report for SARS-CoV-2 vaccines or a non-primary report using an 
Internet-based application, including an electronic version of the VAERS form for SARS-CoV-2 vaccines. 


Maintain procedures to migrate data from VAERS SARS-CoV-2 vaccine manufacturer reports received 
electronically into the database, utilizing appropriate system security precautions. Manufacturer reports 
that must be received electronically include -marketing expedited individual case safety reports (ICSRs), 
periodic ICSRs, as well as malfunction reports and 5-day reports required by the Combination product 
Post-market Safety Reporting Rule. Electronic manufacturer reporting using ICH E2B (R3) is referred to 
as eVAERS. 
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F. All methods tor electronic transmission of reports developed and maintained for this project shall be based 
upon the HL7/ISO 27953-2 specification available at: 
http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=53825, the ICH 
E2B(R3) Implementation Guide available at: http://www.ich.org/products/electronic-standards.html, the 
FDA E2B(R3) Implementation Technical Specification that will be available on CBER’s ICSR website at: 


https://www.fda.gov/industry/about-esg/cber-vaccine-icsr-implementation , or other formats as specified by 
the Government. 


G. Develop, document and implement procedures for the entry and processing of SARS-CoV-2 vaccine report 
data to ensure that the VAERS public data that is made available to the public is redacted of all protected 
health information (PHI) and other information that is protected under the Health Insurance Portability and 
Accountability Act (HIPAA) (http://www.hhs.gov/ocr/privacy/), or otherwise not publicly releasable for 
reasons of commercial confidentiality (as directed by the Government), regardless of the report source 
(paper/fax/other, web, e-report). Government users of VAERS SARS-CoV-2 vaccine data shall have 
access to personal identifiers from the specific fields for names, addresses, telephone numbers, etc. through 
the internet-based report viewing system created and maintained by the Contractor. Such data containing 
PHI shall be included at the direction of the Government in the Government Extract for the CDC, FDA or 
both. 


H. Maintain a methodology to permanently archive electronically submitted VAERS SARS-CoV-2 vaccine 
reports as originally submitted, prior to any editing or redaction. The method shall allow for identification 
and retrieval of the reports from the archive database by specific report identifiers and by organization 
source of origin for reports submitted by manufacturers, state health coordinators, immunization programs, 
other Federal Government agencies and programs, and other parties. 


I. Maintain methods to support a variety of Electronic Data Interchange (EDI) message types specified by the 
Government. The Contractor shall have the capability to both receive and transmit VAERS SARS-CoV-2 
vaccine reports electronically in EDI formats specified by the Government and in additional electronic 
report submission formats consistent with electronic submission requirements based upon the HL7/ISO 
27953-2 specification available at: 
http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=53825, the ICH 
E2B(R3) Implementation Guide available at: http:/Avww.ich.org/products/electronic-standards.html, the 
FDA E2B(R3) Implementation Technical Specification that will be available on CBER’s ICSR website at: 
https://www.fda.gov/industry/about-esg/cber-vaccine-icsr-implementation, and other formats specified by 


the Government. 


J. Under the direction and approval of the Government, the Contractor shall support additional EDI interface 
products for VAERS users, These include products from other vendors that use the VAERS web-reporting 
form, commercial off-the-shelf products, and other products as they are developed. An EDI interface 
product has been developed, utilizing the VAERS internet-based electronic submission form as a means for 
EDI electronic submission of VAEs by VAERS users from their immunizations databases. The Contractor 
shall successfully complete this task for existing, supported EDI interface products within 30 days after 
contract award. The contractor shall successfully complete this task for new EDI interface products of this 
nature within 30 days following direction from Government to perform this task. 


STANDARDIZED METHODS FOR ENTERING AND PROCESSING VAERS SARS-CoV-2 VACCINE REPORTS 
A. Report Data Entry and Processing Timeline Requirements: 


The Contractor shall perform all necessary data entry for information submitted on VAERS forms for 
SARS-CoV-2 vaccine reports and related documents, and editing of the database, with all entry and edits 
tracked by date and entry staff and editors’ individual identification. The Contractor shall be able to 
perform these activities within 30 days after contract award. See Appendix A (also in the section under 
Task 3) for information on scanning, data entry and coding timelines. 
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The timeline requirements for processing reports for VAEs of special interest to the Government (e.g., seizure} may 
differ from the above requirements and will be determined or otherwise agreed upon in SOPs approved by the 
Government. Timelines will be adjusted in response to changing public health needs, such as during a public health 
emergency or if a vaccine recommendation changes (¢.p., a vaccine that was not previously recommended for 
children becomes recommended). 


B. Documentation, SOPs, and user procedure manuals: 


The Contractor shal! perform the following tasks/activities related to adverse events reported after SARS- 
CoV-2 vaccines: 


1. Maintain and update comprehensive documentation of database structure; design and analysis, 
including dictionaries, edits, report processing, and computer programs (including menu driven 
programs); user procedure manuals; and other tasks and functions and any modifications set forth in 
this SOW. Documentation shall adhere to the standards set forth elsewhere within this statement of 
work, to include Capability Maturity Model (CMM} standards. 


2. Provide user-procedure manual(s) and SOP manuals for technical aspects of VAERS SARS-Co¥V-2 
vaccine database operations to the Government within 30 days after contract award. [mplementation 
of all procedures is contingent on Government review and approval. 


3. Maintain, update and provide to the Government as requested complete documentation of the SARS- 
Co¥-2 vaccines database and all regularly produced extracts. The documentation shall be readily 
available to the Government for use or reference and include data dictionaries for the datasets 
(including variable names, formats, descriptions, comprehensive list of legal codes) versions of the 
Medical Dictionary for Regulatory Activities (MedDRA) terms, (www.medramsso.com) or other 
coding language chosen by the Government, and look-up tables for vaccine, manufacturer, and 
MedDRA terms. 


4. Maintain full, detailed documentation for all business and technical aspects of the VAERS SARS- 
Co¥-2 vaccine program. Documentation shall be updated annually or as requested by the 
Government, and maintained in two separate volumes: “Volume 1 - VAERS Business Processes” and 
“Volume 2 —- VAERS IT Requirements and Design” as detailed in the Administrative section of this 
SOW. 


5. Maintain a formal “requirements” database, to be prioritized by a “change request board” consisting of 
CDC, FDA and Contractor personnel. Work shall be prioritized by this process, in both a routine and 
expedited manner as appropriate to the requirement. 


ACKNOWLEDGMENT, VERIFICATION, CODING AND DATA COLLECTION FOR ADVERSE EVENTS 
REPORTED AFTER SARS-CoV-2 VACCINES 
The Contractor shali perform the foliowing tasks/activities: 


A. Review all documents received daily through all channels to prioritize processing, and assign a unique 
index number to each report received and initiate processing based on SOPS for the report category and 
method of transmission. The unique index number (VAERS ID number) shall appear in the personal data 
files and in files created for other information. 


For electronically subrnitted reports and reports submitted using the internet-based reporting application, a 
unique index Electronic Report Number (ERN) shall be generated at the time the report is received, and 
shall be communicated back to the originator of the report using a formal acknowledgement or EDI 
submission confirmation message integrating the E-Report Number into the message. The ERN shall be 
included in the primary system database and in the Government extract, and in relational data tables 
providing linkage between the ERN and VAERS ID number assigned to each report and may be used to 
query the VAERS report in the master database and Government extract. For electronically submitted EDI 


G. 
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reports, sufficient information shall be retained from the EDI VAE message to uniquely identify the report and 
enable tracking and identification of the report within the primary system database. 


Enter into the database all data submitted on report forms and related documents within the time limits 
specified in this SOW. 


Code VAE data after SARS-CoV-2 vaccines on the VAERS report form (paper or electronic form/data), from 
related documents/records, and from additional information sources related to the report (i.e., records obtained 
during follow-up) using the most updated version of MedDRA (http://www.meddra.org/) or other coding source 
specified by the Government. Codes shall be entered into the database. Relational tables and data dictionaries 
shall be provided to the Government for all coding used throughout the system. The Government reserves the 
right to update and replace coding standards as required for the data elements, and reserves the right to 
introduce requirements for standardized coding for data elements not included in this SOW. 


1. The Contractor shall enter into the database SARS-CoV-2 vaccine VAE descriptive clinical information 
and other symptoms, signs, lab data and/or disease entities, including text fields contained in Boxes 9, 10 
11, 12, 18, and 19 on the VAERS reporting form (Available at https://vaers.hhs.gov/uploadFile/index.jsp) 
and code this information using MedDRA (or other coding language chosen by the Government). The 
specific boxes may change if the VAERS form is modified. 


t 


At the direction of the Government, the Contractor shall assess and potentially implement alternative 
methods for coding reports (computer assisted, automated, algorithm generated, ete.}, and conduct post- 
implementation quality assurance. The implementation of alternative coding methods is dependent on the 
availability of core and supplemental funding to support such activities. 


If requested by the Government, in the event that FDA approves new or modified labeling for a SARS- CoV-2 
vaccine, the Contractor shall identify VAEs from the Adverse Reaction, Precautions, and Contraindications 
sections of the labeling and translate them into MedDRA (or other coding language chosen by the Government) 
terminology (known as labeled event data). When there is a change in labeling, the Contractor shall submit 
proposed modifications to the Government and modify the list of terms at the direction of the Government. All 
code lists or labeling changes submitted by the SARS-CoV-2 vaccine manufacturers must be approved by the 
Government before implementation. 


At the direction of the Government, the Contractor shall develop, update, maintain, and provide data 
dictionaries for all data tables provided to the Government including the tables associated with vaccines, 
adverse event coding (MedDRA, or other coding language chosen by the Government), manufacturers, and 
labeled events associated w/vaccines. The labeled event dataset shall indicate labeled events associated with 
SARS-CoV-2 vaccines as identified in vaccine package inserts and product labels. The contractor shall enter 
labeled events within 10 working days following the introduction of a new vaccine or at the direction of the 
Government. The Contractor shall review and update the labeled events table annually or as necessary. 


Comply with the safeguarding procedures for report forms as required by the NCVIA — 42 U.S.C. 300aa- 25, 
and the safeguarding guidelines of the Privacy Act. The Contractor shall ensure that information which could 
identify an individual (such as name, street address, telephone number and email address of the person who 
received the vaccine and that person’s legal representative) shall not be made available to any person other than 
the person who received the vaccine or the legal representative of such person and duly authorized staff of 
CDC, FDA and other participating federal entities. The restriction on access to identifying information applies 
to all information received by the VAERS activity, regardiess of physical format (paper, electronic, other). The 
process shall be subject to review and approval by the Government. 


Maintain storage of original and depersonalized data separately. Records shall be maintained in accordance with 
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Privacy Act regulations and procedures and defined in the Automated Information Systems Security Program 
Handbook. Separate physical and electronic storage of original and redacted report data shail be maintained. 


DATA AND DOCUMENT ACCESS, TRANSMISSION, STORAGE AND RETRIEVAL 
(See Appendix A for detailed information on scanning, data entry and coding timelines). 
The Contractor shall perform the following tasks/functions: 


A. Maintain procedures to complete processing of death, 5-day, 15-day, serious, or other priority reports as 
specified in Appendix A, or upon request of the Government. 


B. Make available to the Government an electronic copy of all received documents within the specified 
timeframes detailed in Appendix A. The Contractor system (currently a virtual private network [VPN] 
containing scanned images) enables Government staff electronic access to reports/documents while 
preserving the integrity of the original document. 


C. Scanned reports and other documents that the Contractor makes available to the Government on the VPN 
do not require redaction unless specified by the Government. 


D. Provide a data extract (Government Extract) of the VAERS SARS-Co¥V-2 vaccine data to the Government 
for storage and use at Government sites (both CDC and FDA) each business day, in accordance with this 
SOW. 


E. Redact all PHI from reports to the VAERS database after SARS-CoV-2 vaccines that appear anywhere on 
the VAERS report form except boxes specifically asking for PHI. For example, if Box 18 on the VAERS 
2.0 form states “I gave Mr. Jones his flu shot and then he had a reaction,” the words “Mr. Jones” should be 
redacted from the VAERS database. 


CHANGES TO REPORT RECIEPT AND PROCESSING 


A. All tasks and activities specified in this SOW that pertain VAERS report receipt and processing are subject 
to change, at the Government’s discretion. 


B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated report receipt and processing procedures and the 
Contractor will be allowed to negotiate implementation of changes. 


TASK 3: VAERS FOLLOW-UP ACTIVITIES AND ENHANCED SURVEILLANCE 
The Contractor shall conduct follow-up on VAERS SARS-CoV-2 vaccine reports as specified by the Government in 
this SOW. Follow-up consists of the 3 parts outlined below: 

e Communication Activities and Automated Record Collection 

è Record Collection and Data Clarification 

e Clinical Activities 


COMMUNICATION ACTIVITIES AND AUTOMATED RECORD COLLECTION FOR VAERS SARS-CoV-2 
VACCINE REPORTS 
The Contractor shall: 


A. Upon receipt of a death report from a family member, provide a condolence letter to express sympathy and 
explain VAERS procedures, 


B. Provide immediate electronic acknowledgement to all persons who submitted VAERS reports via the 
Internet using the online reporting tool. 


C. Provide acknowledgement in the form of a thank-you notification to all persons who submitted VAERS 
reports via paper format. Exceptions to this requirement are family members who report deaths, all 
manufacturers, and all state health coordinator reporters. 
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D. Develop and implement standardized letters, forms, logs, phone scripts and other documents, subject to 
approval by the Government, and implement documents developed by the Government at the direction of 
the Government, in order to verify the accuracy of submitted data. 


E. Maintain procedures to request additional information from reporters or providers if information from 
essential items (2-6, 17, 18, and 21) on the initial VAERS report are missing, inconsistent or invalid. (See 
https://vaers.hhs.gov/pdf/vaers_form.pdf). Essential item numbers are subject to change if the VAERS form 
is altered or updated by the Government. 


F. Maintain procedures to request disposition updates from reporters at 60 days and ! year after report receipt 
for all serious reports with recovery status listed as not recovered. Include a request for any additional 
infonnation. No 60-day update is required if routine follow-up has been conducted on the report. 


RECORD COLLECTION AND DATA CLARIFICATION FOR SARS-CoV-2 VACCINE REPORTS 


A. Forall SARS-Co¥V-2 vaccine reports designated as serious by regulatory definition (death, life-threatening 
illness, hospitalization, prolongation of existing hospital stay, permanent disability, or congenital 
anomaly/birth defect), the Contractor shall attempt to collect follow-up records and additional 
documentation of the event (includes clarification of the event if necessary). In addition, for other adverse 
events of importance as determined by the Government, the Contractor shall attempt to collect follow-up 
records and additional documentation of the event. Follow-up activities include: 


1. Identification and resolution of conflicting or incorrect information in the VAERS database and 
annotation in the VAERS graphic image file. 


2. Retrieval of pertinent medical records including hospital discharge summary, labs, history and physical 
reports, medical, death certificates and/or autopsy reports. In addition, if the vaccination information is 
missing or unclear (e.g., a report states “flu vaccine” but the brand or manufacturer name is missing) 
the vaccination record shall be obtained. 


3. Scanning of all collected documents/records into the VAERS image base. 
4. Other follow-up activities as directed by the Government. 


Upon award of the contract, the Government will provide detailed, standard procedures for follow-up, which are 
subject to change based on the needs of the Government. See Appendix A for required timeframes for follow-up. 
VAERS correspondence can be via email or hardcopy letters. 


Report Confirmation for SARS-CoV-2 Vaccine Reports 


Confirmation correspondence is sent on receipt of a VAERS SARS-CoV-2 vaccine report submitted by a consumer 
or healthcare professional. Hardcopy letters or email correspondence are sent, depending on the person’s 
communications preferences (specified in the VAERS report). Vaccine manufacturers do not receive these 
communications. 


REPORT TYPE FOLLOW-UP CORRESPONDENCE TYPE 


STANDARD - NO MISSING Send letter or email Confirmation* 
INFORMATION 
STANDARD -INFORMATION Send letter or email Confirmation with request for missing 
MISSING information* 


SERIOUS WITH “NO” FOR Send letter or email 60 day follow-up and one year follow- 
RECOVERY STATUS up* 

DEATH REPORTS FROM Send letter only Condolence letter; consumers only* 
FAMILY MEMBERS 
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*The Government will provide the format and wording of the letters for the contractor's use 


Medical Record Requests for SARS-CoV-2 Vaccine Reports 
Requests for medical records are sent in follow-up* to a VAERS SARS-Co¥-2 vaccine report. 


REPORT TYPE FOLLOW-UP CORRESPONDENCE TYPE 


SERIOUS-NON FLU VACCINE Send request for medical records | Request for medical records** 
letter* 

SERIOUS FLU VACCINE Send request for medical records Request for medical records for flu 
for flu vaccine reports letter* vaccine reports** 

NON SERIOUS REPORTS OF Send request for medical records | Request for medical records** 

SPECIAL INTEREST letter* 


DEATH Send request for death certificate | Request for death certificate** 
letter 


FOREIGN PO WE ee 


MANUFACTURER REPORTS None except death or if requested 
by the Government (of special 
interest). 


CLINICAL TRIALS aS oooO 


*The Government will provide a guidance document to specify what records the contractor needs to obtain. 
**The Government will provide the format and wording of the letters for the contractor's use 


CLINICAL ACTIVITIES FOR SARS-CoV-2 VACCINE REPORTS 


A. Clinical staff shall review follow-up records and add a narrative summary to the Government data for each 
report to reflect follow-up records collected. If records are not available, clinical staff may need to contact 
providers or patients to obtain follow-up information. For example, if a patient reports a serious adverse 
event but does not seek medical care, the patient or parent would need to be called to obtain the details and 
outcome of the event. 


B. Clinical staff shall add appropriate MedDRA codes to the record to reflect data from the follow-up. An 
indicator variable will be provided to distinguish between initial and follow-up MedDRA codes, as well as, 
item number on the VAERS form. 


C. Clinical staff shall edit or supplement as needed the relevant VAERS database record based on documents 
collected in follow-up (e.g., if the vaccine records differ from what is on the VAERS report, the vaccine 
information shall be corrected in the VAERS data). 


D. Clinical staff shall complete Government-developed forms for specific reports which are intended to obtain 
supplemental information as directed by the Government. 


E. Clinical staff are expected to pursue any leads that become apparent during the follow-up process and obtain 
information beyond what is detailed on any standard questionnaire that may contribute to an understanding 
of the underlying cause(s) of the adverse event in question. The information obtained from these leads shall 
be documented in narrative format by the follow-up staff. For example, if during follow-up the clinician 
learns that the patient had to be readmitted to the hospital, those records should be obtained and summarized 
in addition to the initial hospital admission records. 


F. Information obtained during follow-up shall be clearly separated from information in the VAERS report 
when entering follow-up data into the VAERS database. The Government will provide instructions on how 
this will be accomplished. Follow-up information will NOT be included in the VAERS public data. 
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G. When unexpected, significant, or unusual findings are identified during the performance of follow-up 
activities, findings shall be shared with FDA and CDC VAERS staff as determined by the professional 
judgment of the clinical staff. 


H. Clinical staff shall stay current on vaccine recommendations and VAEs. A useful resource is the Advisory 
Committee on Immunization Practices website: https://www.cdc.gov/vaccines/hep/acip-recs/index.html 


l. Provide an indicator variable in the database that will specify if the medical records were collected and the 
type of records obtained. 


TASK 4: QUALITY CONTROL FOR VAERS SARS-CoV-2 VACCINE DATA 

The Contractor shall develop and implement a Quality Assurance Program (QAP). The QAP is applicable to all 
functional areas of this SOW and will allow the Government to verify that contract performance objectives are met, 
the best possible contract performance is being provided, and there is continuous improvement in the quality of 
contract services. The QAP is an important tool for using and monitoring performance indicators and ensuring the 
achievement of desired performance measure outcomes. The QAP shall establish quantitative evaluation strategies 
to ensure that contract performance measurements meet or exceed the highest levels of service. 


The Contractor shall work with the Contracting Officer (CO) and Contracting Officer's Representative (COR) to 
develop standardized tools for assessing contract/project activities and provide consistent evaluation scoring. The 
Contractor shall conduct self-assessment and evaluation quarterly through the QAP and other strategies and 
methodologies to ensure quality performance of contract activities. 


The QAP shall establish quantitative evaluation strategies to ensure compliance to the contract performance 
measurements and meet or exceed the highest levels of service. The plan should specify who within the 
Contractor’s organization has oversight for quality initiatives. The Contractor shall provide this plan to the 
Government within 30 days after contract award. The plan should be updated as necessary (at a minimum annually) 
or as instructed by the Government to ensure that it remains current. 


Quality control procedures shall be developed and implemented, subject to review and approval by the COR, for 
submitted data, entered data, scanned images, follow-up data and coded data. The areas to be addressed shall 
include completeness and accuracy of data, recovery status, follow-up, timelines of report processing for serious 
reports, unexpected occurrences (e.z., pandemic influenza, new recommendations), and completeness and accuracy 
of vaccine lot information on all VAERS SARS-Co¥V-2 vaccine reports. 


QUALITY CONTROL AND ASSURANCE FOR ENTERED AND PROCESSED DATA FOR SARS-CoV-2 VACCINE 
REPORTS 


A. The Contractor shall establish, implement, update and maintain standardized methods for confirming the 
quality of processed data through standardized quality contro] and quality assurance procedures designed to 
reduce or eliminate duplicate entries, data inconsistencies or deficiencies. 


B. Subject to Government approval, the Contractor shall develop, demonstrate, document, and implement 
procedures to maintain data quality at a level adequate to support data analysis. The procedures shall 
include: 


l. Automated editing procedures for data entered by the contractor using the Contractor’s internal data 
entry system, including double-entry verification of entered data for select fields in reports as specified 
by this SOW. 


w 


Automated spelling checks for all text fields on the forms that undergo data entry by the contractor 

using the Contractor’s internal data entry system. Automated spelling check functions shall include 

standard and custom dictionary spell check, including abbreviations and medical terminology. This 
process shall detect and alert the operator to possible spelling errors at the time of data entry, so that 
the operator can immediately implement appropriate corrections. 
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3. Incorporation of appropriate field restrictions, legal value checks, and background logic checks in the 
data entry software to ensure that the entered information is logical and appropriate before it is 
accepted. These procedures shall include, but will not be limited to, the following edit-checks listed 
below : 


a. Keystroke edit checks to ensure only correct values for the field are accepted. All other values 
cause the system to post an error/warning message. 


b. Within-field checks to ensure that data are valid for that field (e.g., entering numbers in a Name 
field is invalid and shall be flagged in error/warning). In addition, unusual values in fields, for 
example: |) adverse event onset date before vaccination; 2) interval between vaccination date and 
onset date greater than 10 years, shall be flagged. 


c. Cross-field checks to ensure that information does not conflict with previously entered data (e.g., a 
death date is invalid if it is entered with a value prior to the date of birth or vaccination date/onset 
date prior to date of birth). 


All edit checks procedures shall have the ability to be modified as needed. The data entry system shall 
display warnings or error messages when unusual or incorrect information is entered for new records 
or for existing records which are retrieved and updated. 


4. Automated spelling checks and edit-checks, as described above, used on the web data entry system and 
implemented in a manner that does not impede or significantly increase form completion time by users. 


5. Development, implementation, utilization, documentation and reporting of internally calculated 
variables to define the quality of the data records entered. These variables shall be made available to 
the Government and shall be utilized in quality assurance programs and assessments by the Contractor 
and by the Government. 


6. Establishment of an edit program that outputs missing and non-plausible data for visual verification 
with the corresponding VAERS form image record. 


7, Establishment and implementation of a mechanism for correcting data errors detected in the previous 
steps. 


8. Review of all data on a quarterly basis to examine frequencies of categorical fields and the distribution 
qualities of continuous variables for any non-plausible data, and verification of any non-plausible data 
indicated in this step. 


a. Establishment and implementation of a mechanism for data corrections indicated in the above 
review processes, 


The Contractor shall perform double data entry on all US serious SARS-Co¥V-2 vaccine reports and other 
reports as specified by the Government. The verification process shall include data entry into two 
independent data files by different personnel unless otherwise approved by the Government. Report entries 
shall be matched by identification number and discrepancies shall be resolved. Target permissible data 
entry effort rates shall be subject to review and approval by the Government. If the Government identifies 
significant data entry quality concerns, then the requirement for double-data shall be increased to include 
all reports received until further notice from the Government. 


All data entry procedures shall include real-time automated checks for illogical date relationships, invalid 
vaccine types, unavailable vaccines, invalid vaccine manufacturer combinations, invalid manufacturer or 
lot number, and other invalid data element combinations. Documentation of programming of these edit 

checks shall be submitted to the Government upon request. The data entry process shall be configured so 
initial data entry of records cannot be completed until all flagged data have been accepted as corrected or 
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moved to a queue for subsequent follow-up within one week. These later stages could include, at the 
discretion of the Government: 


1. Addition of a module for acknowledgement letters sent to individual reporters to request clarification 
of missing or erroneous data; and 


2. Referral of records to follow-up staff as described in the Follow-Up Section in this SOW for correction 
or compietion of missing or erroneous data through follow-up activities. 


E. The Contractor shall maintain and update a list of currently available SARS-Cov-2 vaccines during the 
contract period. 


F. The Contractor shall maintain within the Relational Database Management System (RDBMS), a log ofall 
inanual edits of processed data, including deleted files, with date, editor, and nature of edit identified. All 
data contained in files deleted from the database shall be noved to a separate data set that shall remain 
available for review and retrieval. 


G. Any errors identified by the Contractor QA checks or Government shall be corrected in the database. 


QUALITY CONTROL AND ASSURANCE FOR SUBMITTED DATA QUALITY FOR SARS-CoV-2 VACCINE 
REPORTS 


A. The Contractor shall develop, demonstrate, document, and implement mechanisms to detect and request 
missing or discrepant data from the reporter. The requests shall be made in the form of report 
acknowledgment letters or other methods at the direction of or with the approval of the Government and 
shall present incomplete data fields and discrepant data for review and completion or correction by the 
reporter. 


B. The Contractor shall develop, demonstrate, document and implement mechanisms to detect, confirm, and 
link duplicate or redundant VAERS SARS-CoV-2 vaccine reports concerning the same adverse event. 
These mechanisms will be implemented as follows: 


1. Initial data entry duplication search based on several key identifiers (e.g. name, date of birth, sex, 
vaccination date) 


=) 


Two times per week (or as specified hy the Government) data entry duplication search on key 
identifiers, and adverse event. An adverse event is defined as a single “person vaccination event” or the 
combination of a patient, reported vaccine(s), and adverse event(s), submitted by one or more 
reporters. 


The following business rules and definitions shall apply to this activity: 


a. The first SARS-Co¥V-2 vaccine report received by VAERS for a given adverse event shall be 
defined as the Primary Repori. Other reports received after the Primary Report has been received 
and processed by the system shall be defined as Secondary Reports. 


b. Any SARS-Co¥V-2 vaccine reports received by VAERS after the Primary Report has been 
received, which are exact duplicates (photocopies or identical printouts or identical web based 
reports) of the Primary Report, shall be defined as Exact Duplicate Reports. These Exact 
Duplicate Reports shall be destroyed upon recognition. 


c, Any SARS-CoV-2 vaccine reports received by VAERS after the Primary Report has been 
received, which relate to the same “person vaccination event”, hut which are not exact duplicates 
of the Primary Report, shall be defined as Redundant Reports. Redundant reports may originate 
from different reporters reporting the same “person vaccination event”, or may originate from the 


Page 21 of 47 


same reporter as the Primary Report, or may provide different information about the adverse 
event, including information updates. 


d. All SARS-CoV-2 vaccine reports that relate to the same “person vaccination event” shail be 
grouped together based on the VAERS ID for the Primary Report. 


e. The manner of identifying the Primary SARS-CoV-2 vaccine Report and all subsequent 
(Secondary) reports shall be as follows, unless otherwise indicated by the Government. The 
Primary Report shall have the VAERS ID assigned at the time the report is entered into the 
system, followed by the identifier “-1”. The first subsequent VAERS report concerning the same 
“person vaccination event” shall be assigned a “Linked Report” VAERS ID, which shall be the 
VAERS ID for the Primary Report, followed by the identifier “-2”, at the time the report is 
identified as a redundant report. The second subsequent VAERS report concerning the same 
“person vaccination event” shall be assigned a VAERS ID, which shall be the VAERS ID for the 
Primary Report, followed by the identifier “-3”, at the time the report is identified as a redundant 
report. Subsequent redundant reports shall continue to be numbered accerding to this pattern. The 
identifier digit following the hyphen shall be known as the “order number”. 


f. Assigning status regarding the serious nature (Item 21) on the VAERS form: death, life 
threatening illness, emergency room/departinent or urgent care visit, , hospitalization, prolongation 
of existing hospitalization, disability or permanent damage, congenital anomaly or birth defect, 
doctor or other health care professional office visit, none of the above) of the “person vaccination 
event” reported, as defined in 21 CFR 600.80, shall be based on the highest degree of severity for 
any of the reports received for a specific “person vaccination event”. The report with the highest 
degree of severity shall take precedence in the determination of serious/non-serious status if 
discrepancies exist between the original report and subsequent reports. If there is uncertainty 
regarding a report’s status as being serious or non-serious, reports should generally be adjudicated 
in favor of serious status. 


As required, the Contractor shall develop, demonstrate, document, and implement a methodology by which 
data submitted by multiple reporters, in multiple documents from the same reporter, or obtained through 
follow-up or verification activities regarding the same event, are combined to create a composite table or 
tables which include the reconciliation of conflicting information through follow-up with the reporter, 
health care provider or parent/vaccine recipient. The Contractor shall amend the primary report with 
information from subsequent multiple reports on the same adverse event (“person vaccination event”), 
based on the accuracy of the information (e.g. medical records, follow-up information) or Government 
approval. 


When a VAERS SARS-CoV-2 vaccine report is identified as being a Redundant Report or Duplicate 
Report and has been reassigned a VAERS report identification number based on the VAERS ID for the 
Primary Report with appropriate identifier tag (e.g., VAERS ID = 123456-2), the Contractor shall retain the 
VAERS ID number which has been replaced (referred to here as “Old VAERS ID”) for the specific report 
in an accessible file for mapping to the current VAERS ID. 


The Old VAERS ID shall be retained in a data table linked to the primary VAERS database to allow for the 
search and identification of any specific VAERS report by either the first VAERS ID assigned (the Primary 
Report ID until a report is identified as Duplicate or Redundant) or subsequently reassigned Linked Report 
ID. 


The Contractor shall develop, demonstrate, document, and implement a coding variable (Patient Continuity 
Code) which shall be used to link a patient identified in a report to other reports in which that particular 
patient has been identified. Such reports may include Redundant and Duplicate Reports but may also 
include different “person vaccination events” regarding the same person, but a different vaccination and/or 
event. The Patient Continuity Code shall be included in the primary system database and in the 
Government Extract. 


K. 
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The Contractor shall develop, demonstrate, document, and implement measures for batch-matching to 
identify redundant or secondary reports. The Contractor shall evaluate a variety of methods including 
“fuzzy logic” (http://en.wikipedia.org/wiki/Fuzzy logic) for identifying possible duplicate or redundant 
reports, including reports linked with minor name variations, and implement them at the Government’s 
discretion. An example of the use of fuzzy logic would be linking two different VAERS reports of a very 
rare occurrence in two patients who have the same birthdate and same date of vaccination but no name 
reported, into one VAERS report if the Contractor believes the two reports pertain to the same patient. 


The Contractor shall develop and maintain methods for confirming the quality of submitted data through 
standardized quality control and quality assurance procedures designed to reduce or eliminate the presence 
of more than one record concerning the same adverse event, data inconsistencies or deficiencies. 


With data provided by the Goverment, the Contractor shall develop and implement procedures to provide 
selection lists for valid vaccine lot identifiers (lot numbers) and data entry masks based on known lot 
numbers to provide information at the point of data entry as to the validity of the vaccine lot number 
entered. The Contractor shall develop and implement procedures to detect and specifically demarcate 
records containing reported vaccine lot identifiers, which are not valid lot numbers, based on comparison 
with lot identifier data provided by vaccine manufacturers through the FDA and provided to the contractor. 
These procedures shall be utilized for the Contractor internal data entry system. 


Upon provision of SARS-CoV-2 vaccine manufacturers’ lot numbers to the Contractor hy the FDA, lot 
numbers in the database shall be flagged if not valid when compared to the manufacturer’s master data. 


Any errors identified by the Contractor QA checks or Government should be corrected in the data. 


UALITY CONTROL AND ASSURANCE FOR SCANNED DATA QUALITY FOR SARS-CoV-2 VACCINE 
REPORTS 


A. 


B. 


The Contractor shall develop and maintain methods for assuring the quality of document images for the 
image database and correct indexing in the image database through standardized quality control and quality 
assurance procedures designed to confirm that documents are as legible as possible, complete, and capable 
of retrieval and copying from image base prior to final transfer of original physical document to the 
Government for archiving. 


Any errors identified by the Contractor QA checks or Government should be corrected in the data. 


QUALITY CONTROL AND ASSURANCE FOR CODED DATA QUALITY FOR SARS-CoV-2 VACCINE REPORTS 


A. 


The Contractor shall develop and maintain methods for assuring quality and consistency and the most 
current version of coding in Medical Dictionary for Regulatory Activities (MedDRA) (or other coding 
language chosen by the Government) and the accuracy and completeness of MedDRA coding subinitted by 
manufacturers in their reports. The Contractor shall notify the Government of changes made to the 
MedDRA codes relevant to the VAERS data coding activities and provide a full report and summary of 
each updated version of MedDRA. 


The Contractor shall develop and implement a training program for all data entry and coding staff which 
shall require approval by the Government. The Contractor shall enforce a certification process that requires 
all coders to be trained and become certified coders for current code-based data. This shal] include 
MedDRA, or another coding system chosen by the Government. The data system shall include a coder- 
signature field to indicate the specific coder staff person who performed the report coding. 


The Contractor shall develop or procure and use automated tools, such as auto-coding software, algorithms 
and aides, when available and approved by the Government, to assist in the coding process. 


The Contractor shall provide online manuals for coders to use al any time so that coders can access 
simulated scenarios and glean applicable codes. 
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E. The Contractor shall document any non-standard coding values in use by the VAERS program and 
submitted in reports. 


F. The Contractor shall implement QA procedures and reviews to ensure that data provided as part of 
Government data extracts meet pre-specified requirements as directed by the Government. Procedures for 
data entry error identification, correction and supplemental data entry should be established by the 
contractor in advance of any error detection by the Government. 


G. The Contractor shall develop and implement a QAP which shall include performance quality measures for 
each of the elements in this section of the SOW, and which shall require approval by the COR prior to 
implementation. The Contractor shall perform evaluation of these performance quality measures and report 
the results to the Government annually or on an alternate schedule as specified by the Government and 
propose procedure mndifications as necessary to ensure data quality. The resultant modifications to QA 
procedures shall be periodically implemented contingent upon approval by the COR or CO. 


H. Any errors identified by the Contractor QA checks or Government shall be corrected in the data. 


QUALITY CONTROL UPDATES FOR SARS-Col-2 VACCINE REPORTS 


A. The Government reserves the right to direct the Contractor to revise and update QA procedures in the QAP 
to support changes in reporting procedures, such as changes to the VAERS form, online reporting tool, or 
standard methods of reporting (i.e., transitioning to fully electronic reporting). 


B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated QA procedures and the Contractor will be allowed to 
negotiate implementation of changes. 


TASK 5: INFORMATION MANAGEMENT FOR SARS-CoV-2 VACCINE REPORTS 


A. VAERS is an integrated system that encompasses information technology, data management, data 
analysis, software development lifecycle and IT security. The Contractor shall perform the following 
tasks/activities: 


1. Maintain Capability Maturity Model (CMM) Level 3 certification or higher throughout the 
performance period of the contract and provide the Government current documentation of its CMM 
Level 3 or higher certification. 

2. Maintain current system operations 

3. Provide software development, enhancement and progress reviews as requested by the Government. 

4. Provide software documentation inclusive but not limited to systems requirements, specifications, 
architecture details, design details, analytical algorithms, data models, and technical support processes. 
All documentation shall be submitted to the Government in each annual report and during and 


following the implementation of system changes. 


5. Provide data extractions and depersonalized data sets requested by the Government on a routine and 
ad-hoc basis 


6. Provide ad hoc searches of VAERS SARS-CoV-2 vaccine data as requested by the Government 


7. Implement appropriate Government policies and regulatory requirements regarding information 
management, information technology, software development, and security. 
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B. The Contractor shall furnish all necessary personnel, facilities, supplies, and equipment, as appropriate, to 
provide the Government with required technical, and operational services, within the general work 
parameters set forth in this Statement of Work. 


VAERS SARS-CoV-2 SYSTEM SPECIFICATIONS 


A. The VAERS system shall be hosted on an offsite network consisting of CDC owned software, commercial 
off the shelf software (COTS), and owned and leased hardware. The VAERS Servers will be categorized 
into core, non-core and infrastructure systems. Core systems are those identified with core business 
functionality, non-core provides support for the core systems. The infrastructure servers will provide 
centralized security, network, authentication, storage, remote access and management of all the VAERS 
environments. These servers may consist of a combination of physical and virtual servers, though virtual 
servers are recommended. 


The VAERS architecture should consist of two separate Security Sockets Layer (SSL) virtual private 
networks (VPN), one contains the production and software development lifecycle (SDL) environment, and 
the second located offsite contains a disaster recovery environment. The disaster recovery site is a 
duplicate and replication of the production site and provides recovery of the production site within 24 hours 
(refer to Task 1: ADMINISTRATIVE for physical location requirements for the offsite environment for 
disaster recovery, i.c., the disaster recovery site). 


Below is an example of the approximate number of development, testing and user acceptance servers 
needed for the system: 


| Environment |  Physieał | Virtual | 


Development E ee 
Testing => 
User Acceptance ET. r 


B. Software to be installed on these machines includes but is not limited to: 


Activator, ColdFusion, Apache, Biscom FAXCOM, CentOS Enterprise Linux, Chado Software, SpellText, 
Cisco ASA software, Cisco IOS, CopSSH, Doubletake, Express Metrix, Faxcom, HP Array Configuration 
Utility, IBM Rational Tools, itefix CopSSH, Java, Jpeg Wizard, Kofax Capture, Macromedia CFMX, 
Medical/Pharmaceutical Spellchecker, Microsoft Active Directory, Microsoft Remote Desktop Version 10, 
Microsoft Windows server 2016, Microsoft HIS, MS Office, MS OS, Microsoft SQL 2017, Microsoft VSS, 
NSChent++, PHINMS, Python, rDist, Redhat Enterprise Linux, rSync, RSA Authentication Manager, RSA 
Radius Server, SAS, Screen, SourceForge GNUWin32, SpellText, Stedman’s spellchecker, Superftexible, 
Symantec Backup Exec Agent, Symantic Antivirus, Tripwire for Servers, VMWARE, Zope 


Contractor must license or own software (or equivalent) as listed above. 


C. Contractor must develop a VAERS Virtual Private Networks (VPN) which allows authorized users located 
outside of the Contractor’s facility to establish a secure connection to the VAERS application. The 
VAERS VPNs will provide a secure computer network that uses the Internet to allow remote users secure 
access to the VAERS application and database. It should encapsulate data transfers each business day, 
between the authorized users and Contractor’s networked devices to keep transferred data private from 
other devices on one or more intervening local or wide area networks. Depending on the user’s access 
rights to the VAERS database, the individual will either be part of a VPN with full access to the VAERS 
database or a more restricted VPN only providing access to reports of selected research interest. The 
Contractor adheres to the following and is expected to create and maintain capabilities to perform these 
functions: 
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Conduct web based query 

Enable viewing of scanned images 

Enable viewing of entered data including Follow up and MedDRA code 
Enable viewing of nurse follow up module 


D. Other VAERS functionality requirements include: 


l. Creation ofa VAERS SARS-CoV-2 vaccine public website and online reporting tool which 
includes a mechanism for allowing patients, parents, providers and other partners and stakeholders 
to electronically subinit VAERS reports 


2. Creation of an intranet application that allows authorized staff to access SARS-CoV-2 vaccine 
reports to query, add and modify data, and view linked images 


3. Double data entry of specific report types as determined by the Government 


4. Scanning of hard copy documents including, but not limited to, VAERS SARS-CoV-2 vaccine 
report and medical documentation. 


5. Receipt of electronic SARS-CoV-2 vaccine reports from manufacturers (e VAERS) 


6. Electronic transmission of reports and data extractions to CDC and FDA as specified by the 
Government 


7. Business Intelligence 

8. Data warehousing 

9. Data editing 

10. Duplicate identification 

11, Database management system and tools 

12. Software for extracting and transmission of Government specified data sets. 
DATA MANAGEMENT 


A. All Information Technology (IT) systems must comply with federal regulations and policies regarding IT 
which includes but are not limited to Enterprise Performance Life Cycle (EPLC), Capital Planning and 
Investment Control (CPIC), Information Security, Section 508 of the Rehabilitation Act, Enterprise 
Architecture (EA), etc. 


B. These methods, procedures and processes will accept reports submitted by business partners including 
manufacturers, state health coordinators, and other immunization programs, other Federal Government 
agencies and programs, and other parties. 

Electronic manufacturer reports include post-marketing adverse drug reaction (ADR) data for individual 
cases, post-marketing expedited ADR reports and periodic ADR reports. Electronic manufacturer reports 
shall conform to the format and processes identified and implemented hy the US Food and Drug 
Administration (FDA). This reporting process is referred to as eVAERS. 


C. Under the direction of the CO and COR, the Contractor shall establish and maintain methods, procedures 
and processes to support a variety of Electronic Data Interchange (EDI) message types to be specified by 
the Government. The contractor will work with SARS-CoV-2 vaccine manufacturers (approved by 
Government), to ensure electronic submission of postmarket individual case safety reports (ICSRs) to 
VAERS using E2B(R3) and submitting via xml format. Electronic reporting of vaccine postmarketing 
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safety reports shali follow the International Council on Harmonisation’s (ICH) E2B(R3) ICSR specification 
: https://www.federalregister.gov/documents/2014/06/10/2014-13480/postmarketing-safety-reports-for- 
human-drug-and-biological-products-electronic-submission 


STANDARDIZED METHODS FOR PROVIDING ROUTINE AND REQUESTED REPORTS OF VAERS SARS-CoV- 
2 VACCINE DATA TO THE GOVERNMENT 


A. The Contractor shall perform ad hoc searches of the VAERS SARS-COV-2 vaccines databases to address 
specific surveillance questions and support vaccine safety studies, as requested by the Government. 


B. At the direction of the Government the Contractor shall develop, maintain and update programs to 
routinely produce specific depersonalized data sets containing originally reported information for the public 
websites, World Health Organization (WHO), state health coordinators and others as approved by the 
Government. 


C. The Contractor shall provide a weekly reports of adverse events after SARS-CnV-2 vaccines reported for 
specific jurisdictions via The Epidemic Information Exchange (Epi-X) to those specific State Health 
Coordinators as indicated by the Government, upon request by the Government. 


These reporting requirements are subject to change at the request of the government. 
GOVERNMENT DATA EXTRACTS FOR SARS-CoV-2 VACCINE REPORTS 


A. The quality of the data extract is important to VAERS, therefore, the Contractor shall provide accurate data 
extract (“Government Extract”) to the Government for storage and use at Government sites (both CDC and 
FDA). The data extract and all available data elements collected from the submission of VAERS reports 
and collected through follow-up activities are subject to the approval of the Government and should be 
provided according to the specified timeframes detailed in Appendix A. The complete VAERS SARS-Covy- 
2 vaccine database, containing both (a) all data elements from the YAERS form which include those data- 
elements historically used by the Government, and (b) any new and valuable data-elements added by the 
Contractor by the direction of the Government shall be provided daily. All data elements collected on the 
VAERS form (and subsequent approved revisions of the VAERS form), and subsequent data elements 
collected via internal entry system or web system, are subject for inclusion in the data extract to 
Government. If the data elernent is a specific field on the form, the data shall be stored in a related specific 
field in the Government data, with no concatenation of data fields or elements. The following are examples 
of two processes for important extracts of data from the VAERS system that the Contractor shall follow: 


1. VAERS SARS-CoV-2 VACCINE DAILY EXTRACT - Each business day, the Contractor shall send 
an extract to the CDC and FDA through a low cost data transmission application. Once CDC receives 
the extract, a confirmatory e-mail is submitted to the Contractor verifying that the extract has been 
received. The Contractor shall contact the COR if the confirmatory e-mail is not received. The COR 
will contact the Contractor if there is a problem uploading and processing the data. The Contractor 
shall adhere to the following: 


e = Include initial report data and data obtained in follow up 

e Provide data in a format approved by the Government (CSV format) 

e Maintain manufacturer reports received electronically including postmarketing adverse drug 
reaction (ADR) data for individual] cases, post marketing expedited ADR reports and periodic 
ADR reports. 


2. VAERS SARS-CoV-2 VACCINE PUBLIC EXTRACTS - The Contractor shall be required to 
maintain public redacted databases of VAERS data as specified by the Government. The current 
VAERS public website (www.vaers.hhs.gov) provides downloadable datasets that are subsets of the 
VAERS daily extract that is sent to the CDC and FDA. WONDER, a CDC created online tool located 
at wonder.cdc.gov, is another example of the public databases. This tool allows the public to query a 
subset of the VAERS data. Standard operating procedures are used to ensure patient privacy. The 
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public website and WONDER shall be updated on a weekly basis. There is a one week lag on data so that 
quality control measures can be conducted by the Contractor. The datasets on the public website are split 
into separate CSY files by years dating from 1990 to the current year. Non-domestic (i.e., foreign) reports 
are placed in a separate CSV file. 


3. WAERS SARS-CoV-2 VACCINE OTHER GOVERNMENTAL AGENCIES EXTRACTS- The 
Contractor shall provide VAERS data in comma separated value (CSV) files on a secure server platform 
to specified points of contact among other governmental agencies, Department of Defense (DoD), 

Indian Health Services (IHS), and World Health Organization (WHO), on a weekly basis. 

a. DoD and non-DoD reports will be identified using specific search criteria as outlined in VAERS CDC 
DoD Memorandum of Agreement (MOA). Initial and follow-up unredacted information will be 
provided on DoD reports, while initial redacted information will be provided on non-DoD reports. 

b. FHS and non-JHS reports will be identified using specific search criteria as outlined in VAERS CDC 
IHS Memorandum of Understanding (MOU). Initial and follow-up unredacted information will be 
provided on IHS reports, while initial redacted information will be provided on non-[HS reports. 

c. WHO will be provided initial redacted information, similar to data publicly available at the CDC 


WONDER website: https://wonder.cdc.gov/vaers. html. 


4. VAERS SARS-CoV-2 VACCINE JURISDICITON EXTRACTS- The Contactor shall provide VAERS 
SARS-CoV-2 vaccine data and summary tables to specified jurisdictions using CDC’s Epidemic 
Information Exchange (Epi-X), a secure, web-based network that serves as a powerful information 
exchange between CDC and public health professionals involved in identifying, investigating, and 
responding to public health threats. Data will be posted and refreshed on a weekly basis with a one week 
lag in order to incorporate quality contro! measures conducted by the Contractor. The VAERS SARS- 
CoV-2 vaccine data will include initial report data with personal identifiers, no follow-up will be 
included. Summary tables will also be provided to the jurisdictions, including summary statistics, 
including but not limited to, serious status and conditions of interest. 


5. WAERS SARS-Co¥-2 Priority Report- The Contractor shall provide CDC and FDA with a daily email 
containing a breakdown of SARS-CoV-2 vaccine reports listing VAERS ID by manufacturer, serious 
status, and domestic/foreign country status. The contractor will also provide counts of reports, both daily 
and cumulative, by manufacturer, serious status, and domestic/foreign country status. 


VAERS FUTURE SOFTWARE DEVELOPMENT AND ENHANCEMENTS 


A. At the request of the Government, the Contractor shall develop and enhance software for the VAERS system 
following the HHS, CDC and NCEZID policies and procedures for Enterprise Performance Life Cycle 
(EPLC), Capital Planning and Investment Control (CPIC) and IT security. 

http://www.hhs.gov/ocio/ /index.html 


CONTRACTOR COMPLIANCE WITH APPLICABLE LAWS, REGULATIONS, POLICIES AND STANDARDS 


A. The Contractor shall ensure that the Information Technology Architecture (ITA) for the VAERS system is 
implemented and maintained by the Contractor in compliance with applicable regulations including OMB 
Circular A-130, the Federal Information Resources Management Regulation (FIRMR), the DHHS Automated 
Information Systems Security Program (AISSP) Handbook, and applicable portions of the CDC ITA plan, 
Technical Reference Model and Standards. 


B. IT products and technologies procured through this contract shall meet the applicable accessibility standards 
at 36 CFR 1194, viewable at https://www.gpo.gov/fdsys/granule/CFR-201 1 -title36-vol3/CFR- 201 1-title36- 


vol3-part! 194/content-detail.html 


C. The Contractor shall ensure that all systems are in compliance with Section 208, the privacy provisions of the 
E-Government Act of 2002, and follow the OMB Guidance of September 26, 2003 regarding implementation of 
the privacy provisions of the E-Government Act. 


D. The Contractor shall be responsible for being aware of and shall comply with all applicable federal 
information technology and information management laws, regulations, policies, and standards. These 
include but are not limited to: 
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Children’s Online Privacy Protection Act (COPPA) 
Section 508 of the Rehabilitation Act. HHS Section 508 Product Assessment Template (use 
VPAT version 2.0 or later: https://www.itic.org/policy/accessibility/vpat } 
Clinger-Cohen Act (CCA 
Federal Information Security and Management Act (FISMA) 
Paperwork Reduction Act (PRA 
Office of Management and Budget (OMB), National Institute of Standards and Technology 
(NIST), and General Accounting Office (GAO) policies that can be primarily found at or 
through the Federal CIO Council website at www.cio.gov. 
e Federal Enterprise Architecture (FEA} 


E. The Contractor shall not develop any Internet web applications that use persistent cookies without explicit 
authorization by CDC’s Chief Information Officer. 


F. The Contractor shall adhere to CDC’s Secure Coding Practices guide for developing web-based 
applications to prevent security vulnerabilities. 


G. Contractor's performance and resulting deliverables shall adhere to all federal, HHS, and/or CDC IT 
security policies and procedures. Development or implementation of an electronic information system or 
any electronic data collection effort conducted in the performance of this contract is required to undergo 
Certification and Accreditation (C&A) prior to operation. When applicable, the Contractor shall be 
required to complete all security documentation and materials required to obtain an authority to operate 
(ATO). The Contractor shall comply with all applicable HHS, CDC, FISMA, HIPPA, NIST, and other 
federal policies and regulations in the performance of the security requirements. If an application or system 
is operated by the Contractor on behalf of the Government and/or hosted at a Contractor facility, it shall 
comply with HHS and CDC policies, and is subject to all OMB requirements, including a full Certification 
and Accreditation (C&A) 


YV. TASK ORDER DELIVERABLES AND MILESTONES: 


Deliverable 


Program Management Monthly Status Report as leach tothe | Monthly, first report due 30 days after 
specified in the Administrative section of the COR and TR | contract award 
SOW 
Annual report as specified in the Administrative leach tothe | Annually, due 30 days following the 12 
section of the SOW COR, TR and | months period covered by report 

CO 


Draft Final Report as specified in the l each to the | At least 45 days before the contract 
Administrative section of the SOW. COR and TR | completion date 


Final Report as specified in the Administrative leach tothe | No later than the contract completion 
section of the SOW COR, TR and | date 

co 
Report inventory of all hardware and software, l each tothe | Include in annual report and upon 
including version numbers of software and record | COR and TR | request 
of maintenance as specified in Security section of 
the SOW 
Develop/update and provide standard operating l each tothe | Within 30 days after contract award, 
procedures for all aspects of VAERS operations, COR and TR | within 30 days of implementation of 
including complete VAERS report processing, as changes, and then annually and upon 
specified in the Administrative section of the request 


Deliverable 


Develop and maintain list of names, phone 
numbers, fax numbers, and email addresses of 
contact personnel responsible for reporting from 
state health agencies, vaccine manufacturers, and 
immunization programs as specified in 
Administrative section of the SOW 

Report number, method of contact, type of 
contact with VAERS by manufacturers, state 
health coordinators, immunization programs, and 
the public. 

Provide documentation of the technical procedure 
for data transport to Government as specified in 


the Information Management section of the SOW. 


Provide Government Extract of VAERS data to 
both agencies as specified in the Information 
Management section of the SOW. 

Maintain and provide documentation for a 
current, separate mirror version of the VAERS 
system and RDBMS as specified in SOW. 
Provide user-procedure manual(s) and standard 
operating procedures (manual of operations) for 
technical aspects of VAERS database operations 
Provide documentation for data verification 
procedures including standardized letters, forms, 
logs, phone scripts and other documents as 
specified in SOW 

Provide a weekly report of adverse events after 
SARS-CoV-2 vaccines to Vaccine Safety 
Coordinators and their designees of specific 
jurisdictions as indicated by the Government as 
specified in SOW 

Provide documentation for procedures and rules 
for Data Quality Control and Assurance as 
specified in SOW 

Provide System Security Plan and training 
materials for employee AIS security training 
program as specified in the Information 
Management section of the SOW 

Provide Program Management Plan as specified 
in the Administrative section of the SOW 
Provide Quality Assurance Program (QAP) plan 
as specified in SOW 
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i ar 


1 each to the 
COR and TR 


Within 30 days after contract award, 
then annually, and upon Government 
request. 


leach tothe | Include in the annual report, and upon 
COR and TR | Government request 


| each to the 
COR and TR 


Within 30 days after contract award 


l each to FDA | Beginning 30 days after contract 
and CDC award, and each business day thereafter 
designees 
1 Each to the 
COR and TR 


Within 90 days after contract award 


| each to the 
COR and TR 


30 days after contract award and then 
as specified in SOW 


1 each to the 
COR and TR 


Upon Government request 


l each to the 
COR and TR 


Weekly, beginning 60 days after 
contract award 


1 each to the 
COR and TR 


Provide 60 days after contract award 
then annually or upon request 


1 each to the 
COR and TR 


Within 30 days after contract award, 
then annually 


i each to the | Within 30 days after contract award, 
l each tothe | Within 30 days after contract award, 
COR, TR and | then annually 


co 
Provide list of key project personnel as specified l each tothe | Within 30 days after contract award, 
in SOW COR, TR and | then annually; update within 10 days 
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Provide Earned Value Report as specified in 
Information Management and Administrative 
sections of SOW 

Provide Data System Security Plan or information 
system security plan (SSP) as specified in 
information Management section of SOW 
Provide list of staff who have successfully 
completed information security training as 
specified in Information Management section of 
SOW 

Provide documentation of Level 3 Security 
Requirements compliance as specified in the 
Information Management section of SOW. 
Provide Transition-Out Plan for approval as 
specified in the Administrative section of SOW 
Provide Disaster Recovery Plan for approval as 
specified in the Infonnation Management section 
of SOW 

Provide results of IT Security Risk Management 
Assessment as specified in the Information 
Management section of SOW 

Provide the Government with detailed system 
documentation. Documentation shall be 
maintained in two separate volumes: “Volume 1 
— VAERS Business Processes” and “Volume 2 — 
VAERS IT Requirements and Design” as 
specified in the Administrative section of SOW 
Provide detailed documentation of the technical 
procedures for data transport to CDC and FDA as 
specified in the Administrative section of SOW 


Provide Priority Report of VAERS data to CDC 
and FDA as specified in the Information 
Management section of the SOW. 


CO 
1 each to the 
COR and TR 


1 each to the 
CO and COR 


l] to COR 


1 each to COR 
and TR 


1 each to the 
COR and TR 
1 each to the 
COR and TR 


1 each to the 
COR and TR 


Í each to the 
COR and TR 


1 each to the 
COR and TR 


1 each to 
FDA and 
CDC 

designees 


following key personnel changes 
Include in monthly reports 


Draft within 30 days after contract 
award; final version within 60 days 
after award. 

Upon request by COR 


Within 30 days after contract award 


Within 60 days after contract award 


Within 60 days after contract award 


Within 45 days of completed 
assessment 


Within 30 days after contract award, 
then annually thereafter, with new 
sections or documentation revisions 
provided within 10 days 


Within 30 days after contract award, 
then annually thereafter, with new 
sections or documentation revisions 
provided within 10 days 

Beginning 30 days after contract 
award, and each business day 
thereafter 


The Contractor shall provide, upon request from the Government, deliverables not specifically listed in this 
docurnent. The Government will provide the Contractor with sufficient time (i.e., a minimum of 2 business 
days} to fulfill such requests. 


VI. PERFORMANCE MATRIX: 
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Execute/perform | Meets and All required tasks, 100% COR oversight | Favorable or 
all required tasks | complies with | milestones and compliance Unfavorable 
according to defined task deliverables will be Performance 
performance plan | requirements | achieved within the Evaluation 
agreed-upon 
schedule specified in 
this Statement of 
Work 
| Send timely Each business ] All required tasks, 98% Daily receipt of | Favorable or 
VAERS Daily day the milestones and compliance Extract Unfavorable 
Extracts with Contractor deliverables will be Performance 
correct sends an achieved within the Evaluation 
information extract to the | agreed-upon 
CDC and schedule specified in 
FDA through | this Statement of 
the PHINMS | Work 
or other 
specified 
application. 
Process all Process All required tasks, 100% Monthly Favorable or 
serious reports serious milestones and compliance Quality Reports | Unfavorable 
within the reports inthe | deliverables willbe | All late Performance 
specified established achieved within the | logging of Evaluation 
timeframe timeframe to | agreed-upon adverse 
reflected in electronically | schedule specified in | events 
Appendix A of migrate VAE | this Statement of reports is 
this SOW. data into the Work reported in 
database. monthly 
report. 


VII. PERIOD OF PERFORMANCE: 


08/27/2020 — 08/26/2022 


VII. PLACE GF PERFORMANCE: 
The work will be conducted at the contractor’s facility. 


IX. EQUIPMENT AND INFORMATION: 


The Contractor shall provide hardware, software, office and communications equipment and other resources to be 
used for data receipt, processing, editing, analysis, reporting, transmission, and storage. The Contractor shall 
provide the Government with current and detailed system documentation, including SOPs for all aspects of VAERS 
program operations, including complete VAERS report processing, submitted to the Government for initial review 
and approval within 30 days after contract award and within 30 days of revision or implementation of changes, and 


75D30120F09621 00002 
Page 32 of 32 


minimally on an annual basis nr as requested by the Government thereafter. Please see Task Order 1 
(Adininistrative) for more detail. 


Appendix A: VAERS triaging of reports in business days'-? 


| Subject to change in response to new public health policies and/or events and/or funding availability after discussion between CDC and FDA 

2. Not applicable for GBS reports where a patient is confined te facility longer than the time allowed for follow-up (e.g. patient in 

rehabilitation afler GBS} 

3. Completion includes scanning, data entry, and coding 

4. If final autopsy report is not received within 2 months, make request every 2months 

5. If no records received within 5 days from the original request, make additional requests for COVID-19 up to 3 months. After 3 months of 
unsuccessful attempts, close out case unless patient remains hospitalized.. 
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SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS 


VAERS SAR-Co¥-2 Backlog: Period of Performance 03/01/2021 to 08/31/2021 


SUPPLIES / SERVICES QTY / UNIT UNIT PRICE | NOT TO EXCEED 


[ITEM 
VAERS SARS-CoV-2 
Backlog 
The contractor shall provide CDC and 
FDA technical and programmatic 
support to collect and analyze 
information on vaccine adverse events 
(VAEs), and facilitate reporting to 
VAERS specifically pertaining to 
SARS-CoV-2 and clearing reports 
backlog projected to accumulate from 
contract award through February 28, 
2021. Reference the SOW and all 
associated deliverables. This line item is 
based an estimation of 115,000 
backlogged reports to be cleared in 6 
months. 
This is a T&M, severable line item. 
See Table B.2 for LOE 
PoP: 03/01/2021 — 68/31/2021 


1001 Line(s) Of Accounting: 
9390GLY 2512 2021 75-2124-0943 C5B8111101 (b)(4) 


VAERS SARS-Co¥V-2 
Backlog ODCs 


AJl travel must be in accordance with 
the Federal Travel Regulations (FTR). 
The Contractor shall obtain COR pre- 
approval of estimated travel expenses 
prior to travel occurrence. Charges will 
be submitted for actual costs incurred. 
The contractor shall ensure that the 
requested travel costs will not exceed 
the amount authorized in this task order. 


Other direct costs include travel, 
approved training requirements, and 
items shown in table B.3. All other 
direct costs must be pre-approved by the 
CO and COR prior to occurrence, 


T&M, severable line item 
See Table B.3 approved ODCs 
PoP: 03/01/2021 — 08/31/2021 


1002 Line(s) Of Accounting: 
9390GLY 2512 2021 75-2124-0943 C5B8111161 (b)(4) 


VAERS SARS-CoV-2 
Backlog CAF 


The Contract Access Fee (CAF) is 
0.75% to be applied to the total price for 
contractor performance as billed to the 
government on each Task Order. The 
CAF is paid by the Ordering Agency, 
but remitted to GSA by the Contractor. 
Based on the established CAF rate, the 
Contractor shall include the CAF in each 
proposal. The Contractor shall include 
the CAF as a separate cost element per 
year on all quotes to the government, 
regardless of contract type. The CAF 
shall never be treated as a negotiable 
element between the Contractor and the 
Ordering Agency. The CAF Rate, 
effective at time of the Task Order 
award, shall remain the same for that 
Task Order for the full term of the 
Order. 


Not to Exceed a Total of $150K for 
orders with total value greater than 


$20M per year 


PoP: 08/27/2020 — 08/26/2022 
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1003 Line(s) Of Accounting: 
9390GLY 2512 2021 75-2124-0943 C5B8111161 (b)(4) 


Task Order Total 
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SECTION B.2 — Backlog Level of Effort 


SECTION B.3 — Backlog ODCs 
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STATEMENT OF WORK FOR 
VACCINE ADVERSE EVENT REPORTING SYSTEM (VAERS) 
FOR SARS-COV-2 VACCINES 


I. BACKGROUND: 

The Vaccine Adverse Event Reporting System (VAERS) is a mandated program sponsored jointly by the Centers 
for Disease Control and Prevention (CDC) and the US Food and Drug Administration (FDA). The purpose of this 
project as authorized by the National Childhood Vaccine Injury Act (NCVIA), P.L. 99-660, is to provide a single 
nationwide mechanism to report, analyze and monitor vaccine adverse events (VAEs) that occur after receipt of 
vaccines. It also provides a vehicle for disseminating vaccine safety information to vaccines, family members, health 
care providers, vaccine manufacturers, government agencies, and other partners. 


Vaccines represent one of the most cost-effective means of reducing or eliminating morbidity and mortality from 
selected infectious diseases. However, no vaccine is completely effective or safe. Recommendations for the use of 
vaccines are based on careful weighing of benefits of vaccination and risks of both the disease being vaccinated 
against and the immunization itself. Vaccines currently in routine use have been determined by various expert 
groups and FDA to have benefits that outweigh their risks. As part of any vaccination program, ongoing monitoring 
is essential to ensure that new or rare VAEs are recognized and appropriate neasures taken. Vaccines undergo 
safety and efficacy testing in the laboratory and in controlled clinical studies before licensure or authorization (in the 
case of Emergency Use Authorization). Because these trials are limited in size, duration, and heterogeneity, rare, 
delayed, or unusual events caused by a vaccine may not be detected. Once a vaccine is used in the general 
population, post marketing surveillance is necessary to evaluate such VAEs. 


To meet cach agency’s needs for vaccine safety monitoring data, CDC and FDA have jointly sponsored VAERS 
since 1990. The needs relate to CDC’s public health responsibility for developing and issuing national vaccine 
policy recommendations and FDA’s responsibility for licensing and regulating vaccines. 


VAERS contains reports of VAEs based on two criteria, mandated and voluntary reports. The events mandated for 
healthcare provider and vaccine manufacturer reporting are listed in the Reportable Adverse Events Table (RET) 
available at https://vaers.hhs.gov/docs/VAERS_ Table of Reportable Events Following Vaccination.pdf US- 
manufacturers of vaccines are mandated by 21 CFR Part 600.80 (Attachment 3) to submit reports routinely on a 
periodic basis, as well as iu au expedited manner for more serious events. In addition, healthcare providers are 
eucouraged to report all other clinically significant VAEs following the administration of any US vacciue in ail age 
groups. For all reports, the impetus for reporting is not a presumed causal relationship between the vaccination and 
the event but may be based simply on the occurrence of the event temporally following vaccination and the lack of 
other obvious causes. 


From 2014 through 2018, VAERS received an annual average of 53,000 reports, of which 45,500 were US reports. . 
Of the US reports, 5.0% were classified as serious {i.e., associated with disability, hospitalization, prolongation of 
existing hospitalization, life-threatening illness, congenital anomaly/birth defect, or death [2] CFR 600,80]). Since 
1990, VAERS has received over 740,000 reports, most of which describe mild and self-limited adverse events such 
as injection site reactions and fever. (VAERS government data archive January 18, 2019.) VAERS helps to identify 
important new safety concerns and thereby can help inform vaccine policymakers and healthcare providers. In 
addition, the data are valuable for regulatory actions and vaccine research studies. The US Government considers 
post-licensure/authorization surveillance for any licensed and new vaccines through VAERS to be a nationally 
critical function, and the US Government considers the requirements of the VAERS activity to constitute essential 
services for which auy lapse in coverage of services would be unacceptable. 


The current COVID-19 pandemic and the anticipated COVID-19 vaccination program has created additional 
requirements for VAERS. Unanticipated project needs have materialized, requiring efforts beyond routine VAERS 
functious. Task requirements in support of public health emergencies (e.g., pandemic influeuza, natural disasters 
aud terrorist activities) and unanticipated federal mandates which are unpredictable uecessitate an increase in 
Contractor staffing. These new requirements may result in increased workload for any of the tasks listed in the 
SOW Tasks 1-5. The Contractor shall be prepared to address unforeseen events/circumstances and meet the needs 
of the Government as it relates to such events. Reasonable accommodations will be made to the Contractor by the 
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Government to address unforeseen events/circumstances and the Contractor will be allowed to negotiate the 
implementation of changes. 


Il. OBJECTIVES: 

The Vaccine Adverse Event Reporting System (VAERS) is the nation’s frontline system for detecting potential 
vaccine safely concerns after vaccines are licensed or authorized for use in the United States. It is a nationwide 
mechanism by which VAEs may be reported, analyzed, and made available to the public. It provides a vehicle for 
disseminating vaccine safety information to vaccines, family members, health care providers, vaccine 
manufacturers, government agencies, and other partners. VAERS is a collaboration between CDC and FDA. 


The purpose of this task order is to provide CDC and FDA technical and programmatic support to collect and 
analyze information on vaccine adverse events (VAEs) after administration of SARS-Co¥V-2 vaccines and facilitate 
reporting to VAERS. The objectives of the VAERS Project are divided into three categories: programmatic (mainly 
CDC), scientific (CDC and FDA), and regulatory (FDA). 


Programmatic Project Objectives: 
1. Create and maintain an online reporting website for VAEs following receipt of SARS-CoV-2 vaccines 


2. Implement an electronic subinission gateway for manufacturers to submit VAE reports on SARS-CoV- 2 
vaccines 


3. Provide a reporting mechanism for VAEs that maintains submitted SARS-Co¥V-2 vaccines reports, 
including images of reports and medical documentation; 


4. Ensure data in the VAERS reports are accessible to the public as required by law (P.L. 99-660, Section 
2125), in accordance with policies to protect individuals’ privacy; 


5. Support CDC and FDA scientific staff in using VAERS data on VAEs after SARS-CoV-2 vaccines 10 
rapidly respond to vaccine safety concerns or public health emergencies and in conducting 
epidemiologic and other scientific stndies 


Scientific Project objectives: 
l. Rapidly detect new, unusual, or rare VAEs after SARS-CoV-2 vaccines: 


2. Assess the safety of SARS-CoV-2 vaccines; or assess the safety in specific populations or situations 
where a new recommendation for SARS-CoV-2 vaccines occur; 


3. Rapidly identify vaccine lots for SARS-CoV-2 vaccines with increased numbers or types of reported 
adverse events (FDA lead); and 


4. Monitor trends in known VAEs after SARS-CoV-2 vaccines, particularly increases in reported Y AEs 


Regulatory Project Objectives: 
|. Implement regulatory requirements related to VAERS, especially regarding reports from 


manufacturers after SARS-CoV-2 vaccines. [21 CFR 600.80]. 


Ill. SCOPE OF WORK: 
The contractor shall provide support and technical assistance to CDC and FDA by supporting work in the following 
areas. The tasks below are not in order of priority. These tasks include: 


1. Administrative 

2. Report Receipt/Processing 

3, VAERS Follow Up Activities and Enhanced Surveillance 
4. Quality Control for VAERS Data 

5. Information Management 
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Current VAERS plans, protocols, procedures, manuals, standard operating procedures (SOPs), software, some 
hardware, etc. may be provided by the Government for adoption/modification (i.e., the contractor would not have to 
develop all entirely new products, but would have the option of rolling over/adopting/modifying existing ones). 
Additionally, scanning reports for the image database, certain manual data entry tasks, and other processes clearly 
related to paper reports shall only apply to paper reports (i.e., electronic reports do not require scanning and manual 
data entry, but may require redaction). 


IV. DESCRIPTION OF WORK: 


pe ape alee re te m total number of reports received during periods of peak activity 


(which are not expected to re 


flect sustained activity) is expected to be 1,000 reports per day, with up to 40% of 
the reports serious in nature. M 


TASK 1. ADMINISTRATIVE 


STANDARDIZED METHODS FOR PROVIDING OPERATIONAL SUPPORT FOR THE VAERS PROGRAM. 


A. The Contractor shall maintain Capability Maturity Model (CMM) Level 3 certification (or equivalent) or 
higher throughout the performance period of the contract and shall provide the Government current 
documentation of its CMM Level 3 (or equivalent) or higher certification. 


B. The Contractor shali have staff available for program operations, systems maintenance and consultation 
during normal business hours (8:30 AM Eastern to 5:00 PM Pacific) to accommodate all four time zones 
within the continental United States. The rationale for this requirement is that it is essential for VAERS to 
be fully operational and for staff to be available to conduct systems maintenance and recovery during both 
east and west coast business hours and to also provide a reasonable level of service for the Hawaii-Aleutian 
time zone, since VAERS is a national spontaneous surveillance system. Overtime, afterhours, and weekend 
work is allowed to meet the requirements of this contract. 


C. The Contractor shali maintain a disaster recovery site for data management, data storage and all other 
VAERS data and IT functions that duplicates and replicates the primary production site and provides 
recovery of the production site within 24 hours (refer to Task 5: INFORMATION MANAGEMENT for 
capability requirements). This site shall be at least 100 miles away from the primary production site. The 
rationale for this requirement is that the disaster recovery site must be sufficiently distanced from the 
immediate area of the primary production site, but realistically within a business day’s drive during an 
emergency. 


D. The Contractor shall provide hardware, software, office and communications equipment and other 
resources to be used for data receipt, processing, editing, analysis, reporting, transmission, and storage. 
The Contractor shall ensure systems compatibility with CDC and FDA software and hardware 
requirements. The Contractor shall ensure that applicable technology is capable of upgrade or provide for 
replacement with later technology if necessary. Hardware, software and equipment shall be maintained and 
upgraded in accordance with industry standards for IT and telecommunications equipment including 
routine maintenance. 


E. The Contractor shall upgrade VAERS program and related applications at the Government’s direction 
through official modification signed by the Contracting Officer (CO), based on requirements gathered from 
Government and other program stakeholders, using structured, phased software development methodology. 


F. The Contractor shall provide the Government with current and detailed system documentation. 
Documentation shall be maintained in two separate volumes: “Volume | — VAERS Business Processes” 
and “Volume 2 — VAERS IT Requirements and Design”. Requirements shall be maintained in a formal 
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requirements database, to be prioritized by a change contro] board consisting of CDC, FDA and Contractor 
personnel. Work will be prioritized using this process, in both a routine and expedited manner as 
appropriate. The Contractor must demonstrate adherence to formal CMM Level 3 methodology as the 
standard for project performance. System documentation will be presented in standardized text format, 
generated in Microsoft Word document format (or other word processing format as specified by the 
Government), with all diagrams and other graphics contained as embedded objects with no external files or 
links, and presented in legible paper form or electronic form if requested by the Government. The 
Contractor shall provide detailed documentation of the technical procedures for data transport to the CDC 
and FDA, and documentation of technical details for source code and code relation, library dependencies, 
and data transport mechanisms. The Contractor shall provide the Government with this documentation 
within 30 days after contract award and annuaily or as requested thereafter, and new sections or 
documentation revisions will be provided to the Government upon implementation of changes in the 
system or procedures. 


G. The contractor shall communicate with CDC and FDA, any requested changes to the system (including, but 
not limited to database structure, and data processes) prior to implementation. Modifications/changes will 
not be performed until approval from CDC and FDA. 


H. The Contractor shall write standard operating procedures (SOPs) and modify them as needed. SOPs for all 
aspects of VAERS program operations, including complete VAERS report processing, shall be updated and 
provided to the Government annually or as requested. All SOPs shail be submitted to the Government for 
initial review and approval within 30 days after contract award and within 30 days of revision or 
implementation of changes, and minimally on an annual basis or as requested by the Government 
thereafter. SOPs shall be provided in a voinme or series of volumes organized by subject, and will be 
presented in standardized text format, generated in Microsoft Word document format (or other word 
processing format as specified by the Government), with all diagrams and other graphics contained as 
embedded objects with no external files or links. 


I. The Contractor shall provide VAERS operations and system orientation for Government employees as 
necessary (minimum once per year). 


J. The Contractor shall produce and distribute the VAERS reporting form (Attachment A) and other forms as 
required for the operation of the YAERS program and reporting to VAERS. The VAERS program shali be 
identified as a Government program and the corporate name of the Contractor shail not be used on any 
form or correspondence to any entity other than CDC, FDA, or VICP, or used in any communication to 
represent the VAERS program unless approved by the Government. 


K. The Contractor shali maintain lists of names, phone numbers, fax numbers, and 
E-mail addresses of contact personnel responsible for reporting from state health agencies, vaccine 
manufacturers, and immunization programs, limiting access and use to WAERS purposes only. The 
Contractor shall] update this list on a quarterly basis and maintain this list for access by the Government in a 
manner specified by the Government. 


The contractor shall shred all incoining documents once they are permanently saved electronically. 


M. The Contractor shall establish, implement and inaintain selected work groups as 
reyuired by the Government throughout the life cycle of the contract, as needed and directed by the 
Government, and shall take and distribute minutes for working group meetings at the direction of the 
Government. 


TRANSITION OF CONTRACT SERVICES 
The Government considers VAERS an essential service; any lapse in coverage is considered nnacceptable and can 
result in possible termination of contract. The Government requires a smooth and orderly transition of services. 


A. No later than 60 days after the contract award the Contractor shall have established a system of operations 
as described elsewhere in this SOW and perform a functional evaluation of the system. Furthermore, the 
Contractor shall be able to receive WAERS reports after SARS-CoV-2 vaccines via any of the means 
specified in this contract (including electronically submitted reports from manufactures (eVAERS) and 
public (website). The Contractor shail also be able to perform all activities involving the handling and 
processing of reports submitted to VAERS including report receipt, processing, data entry, coding, quality 
control, and report follow-up and verification. Contractor shall be able to provide data to the Government 
in the manners specified within this SOW, including the provision of data extracts, reports and report 
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images, and meet this timeline development requirement as indicated for other activities and functions 
described within this SOW. 


B. No later than 60 days after contract award the VAERS system maintained by the Contractor shall be fully 
operational and shall meet the satisfaction of the Government as to operational functionality. 


C. No later than 60 days after contract award the Contractor shall meet all developmental and operational 
requirements in this SOW unless other specific timeline requirements for those requirements have been 
specified in the SOW. 


D. No later than 60 days after contract award, the Contractor shall provide a Transition-Out Plan (end of 
performance period). The plan shall include a technical and management transition approach that is clear 
and complete and include a timeline and list of resources required for the transition. The Transition-Out 
Plan shall detail the planned transition methodology in logical sequence to ensure a smooth transition of all 
tasks and subtasks without interruption or decline in service quality. The plan shall aiso include a detailed 
description of risks (cost, technical, and performance) to both the Contractor and the Government, as well 
as risk mitigation strategies. Contractors shail also include all transition costs within their proposals. Please 
note that the continuity of services clause 52.237-3 is applicable and should be considered in developing 
the transition plan. 


All documents and materials developed by the Contractor for the fulfillment of this contract, including all SOPs, 
manuals, security plans, management plans and plans of operations. and hardware shall be considered the property 
of the Government and may be disposed of by the Government in any manner at the Government's discretion. 


CHANGES TO INFORMATION MANAGEMENT PROCEDURES AND TASKS 


A. All tasks and activities specified in this SOW that pertain Informination Management are subject to change, 
at the Government’s discretion, to accommodate and support fuliy electronic reporting to VAERS. 


B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated Information Management procedures and the Contractor 
will be allowed to negotiate implementation of changes within the scope via official modification. 


UNFORESEEN EVENTS/CIRCUMSTANCES 

Unanticipated project needs may materialize, requiring efforts beyond those described in this SOW. The 
Government may modify the contract to add task requirements (or enhance/expand current requirements) in support 
of public health emergencies (e.g. pandemic flu, natural disasters and terrorist activities) and unknown Federal 
mandates which are unpredictable and can initiate a workload surge, necessitating an increase in Contractor staffing. 
These new requirements may result in increased workload for any of the tasks listed in the SOW Tasks 1-5. 


A. Approval Process for Unforeseen Events and Circumstances 
CDC will provide the new work requirements and deliverables for each of the optional support services to 
the Contracting Officer (CO) as a revision to the SOW. The CO will send the contractor the revised SOW 
containing the new requirements. The contractor will review the requirements and provide a technical and 
cost proposal with the appropriate labor categories, number of hours, and labor rates to the CO. A contract 
modification (SF30) inust be awarded by the CO to add any new optional support requirement. The 
contractor must not work outside of the SOW without authorization from the CO. 


B. The Contractor shall be prepared to address unforeseen events/circumstances and meet the needs of the 
Governinent as it relates to any unforeseen events/circumstances, Reasonable accommodations will be 
made to the Contractor by the Government to address unforeseen events/circumstances and the Contractor 
will be allowed to negotiate the unplementation of changes. 
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C. The implementation of activities to address unforeseen events/circumstances specified by the Government 
is dependent on the availability of core and supplemental funding to support such activities. 


D. Examples of unforeseen events/circumstances that have impacted VAERS operations include (1) changes 
in the IT certification and accreditation process, (2) changes in regulatory requirements for reporting WAEs 
and transmitting data to CDC and FDA, (3) introduction of new vaccines resulting in necessary coding and 
database architecture changes, (4) changes in reporting requirements, report processing procedures, and 
data availability timelines to meet current public health needs, (5) urgently needed IT capability during 
public health emergencies or in preparation for anticipated public health emergencies, and (6) hardware and 
software upgrades to accommodate unforeseen events/circumstances. This is not an exhaustive list and 
other unforeseen events/circumstances may occur throughout the course of the contract performance 
period. 


PROGRAM MANAGEMENT PLAN FOR CONTRACT ACTIVITIES 


A. The Contractor shall develop and maintain a Program Management Plan (PMP). The Contractor shall 
prepare and maintain a phased Program Management Plan describing the tasks, milestones, risk 
Management strategy, organizational resources, performance measures and management control to be 
employed to meet the cost, performance requirements and schedule of each phase of the VAERS project. 
The plan shail define the Contractor’s governance process and include: 


1. The management structure of the Program Management Team, organizational charts, key personnel 
and main points of contact, and identification of project teams and their roles and responsibilities. 


te 


Identification of all partners, sub-contracts, sub-contractor management, criteria for selection of sub- 
contractors, and description of services to be performed by sub-contractors. The Contractor shall not 
sub-contract out more than 25% of the work described in this SOW (i.¢., 75% of the work 
requirements described in this SOW must be completed by the prime Contractor). Sub-contracting out 
clinical services tasks, report processing and data entry, coding, report follow-up activities, core IT 
activities, quality assurance, and core business and administrative tasks is strongly discouraged and 
will be viewed unfavorably and result in possible termination of contract. 


3. Detailed mitigation response procedures in the event of unsatisfactory performance of program/project 
team members or sub-contractors. 


4. Specification of strategies to include detailed timelines with critical milestones to ensure that both 
long-term, strategic goals as well as specific, targeted objectives are met efficiently and effectively. 


5. The Contractor shall submit the PMP to the Government within 30 days after contract award and shall 
provide updates to the PMP annually or as requested by the Government. The PMP shall be in 
accordance with OMB Circular A-11, and the Federal IT Capital Programming Guide, Supplement to 
Part 7 of Circular No, A-11. Approval of the PMP by the Government shall be required. 


B. Key Project Personnel: The Contractor shall einploy and retain competent, qualified personnel to perform 
services of this contract in an effective, prompt, accurate, courteous and efficient manner. The Contractor 
shall provide a plan for staffing key positions for this project, providing detail about the criteria and 
selection process used to fulfill the requirements of this contract, and shal! notify CDC in the event of 
changes in staffing of key positions. Staffing of these key positions shall be subject to Government 
approval. The Contractor shall provide all necessary supervisory, project management, managerial, clinical, 
technical and administrative support to meet the planning, implementation, operational and management 
requirements of this contract. 


**NOTE FOR ALL TASKS 
Qualifications for personnel performing clinical activity (clinical staff) shail be subject to approval by the 
Government; the minimal education and experience qualifications for this activity shall be a nurse or other 
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clinical healthcare provider, with a minimum of 2 years of clinical or public health related experience. The 
manager of the follow-up activity shall be, at a minimum, an RN, PA, MD, DO or equivalent (e.g., MD 
from a foreign country who is not licensed to practice in the United States), The manager is required to 
have at least 2 years of clinical experience. The manager shall work closely with the Government to ensure 
that follow-up is conducted according to Government expectations, 


REPORTING REQUIRMENTS: 


A. PROGRAM MANAGEMENT MONTHLY STATUS REPORT - The contractor shall provide the 
Government with a monthly Program Management Monthly Status Report electronically to include the 
project’s cost, progress, and issues in a format as directed by the Government. A copy of each monthly 
report shall be sent to the COR, the CO, and the FDA Technical Representative. The contractor shall 
document in the report the efforts performed in the completion of each project task. The report shall be due 
on the 15th day of each month following the month reported upon. 


The Contractor shall propose format and data element recommendations for this report. The final format of 
the report shall be determined upon contract award. 


B. ANNUAL REPORT - On an annual basis, the Contractor shall provide a written report to the Government 
documenting significant work activities and accomplishments for the preceding 12-month period. This 
report shall provide a historical record of major work activities accomplished, those ongoing and those not 
accomplished for the reporting period. As an appendix to the annual report, the Contractor shall deliver to 
the Government the current database dictionaries, standard operating procedures, and user manuals. The 
annual report shall be delivered to the Government no later than 30 days following the specified reporting 
period. One report shall be sent to the COR, the CO, and the FDA Technical Representative. 


p DRAFT FINAL REPORT - The Contractor shall provide a draft final contract report no later than 
45 days prior to the expiration date of year 2 of this contract for review by the Government. The report 
shall include a written narrative highlighting major accomplishments under the contract. The report shall 
address each year of performance under the contract and document significant contractor findings, 
conclusions, recommendations, etc., to provide an objective review of contract activities. The Contractor 
shall provide copies of each draft final report electronically, and optional paper copies at the Government’s 
request. One report shall be sent to the COR, the CO, and the FDA Technical Representative. 


D. FINAL REPORT - Following review of the draft final report by the Government and receipt by the 
Contractor of the Government’s written comments, the contractor shall provide a final report on or before 
the expiration date of the contract. The Contractor shall provide copies of each final report electronically, 
and optional paper copies at the Government’s request. The report shall be sent to the COR, the CO, and 
the FDA Technical Representative. 


FORMAT OF DELIVERABLES 

Specific form format and additional content requirements of the delivery schedule items shall be coordinated 
between the Contractor and the Government, with a continued focus on providing useful and accurate reporting. 
The COR will provide the Contractor with disposal instructions for ail technical documents (including, but not 
limited to all database dictionaries, databases, software, computer code, documentation, questionnaires, electronic 
files, etc.) in possession of the contractor at contract completion. 


TASK 2. REPORT RECEIPT/PROCESSING 


REPORTING TO THE VACCINE ADVERSE EVENT REPORTING SYSTEM (VAERS) AFTER SARS-CaV-2 
VACCINES 
The Contractor shall perform the following tasks/activities: 


A. Maintain communication protocols to provide assistance to the public for Vaccine Adverse Event 
Reporting System (VAERS) after SARS-Co¥-2 vaccine-related questions. Communication protocols shall 


Q: 
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involve appropriate telecommunication and electronic mechanisms for answering questions related to 
VAERS SARS-CoY¥-2 vaccine reporting and the VAERS system (e.g., how to obtain reporting forms, 
options for reporting, information referrals), and allowing for filing of Y AERS reports over the phone in 
English or Spanish. The Contractor shall maintain communication protocols including, but not limited to: a 
toll-free telephone number and toll-free telefacsimile number to be listed as VAERS; a web site identified 
as VAERS, and an e-mail address (e-mail address may be specified by Government). The Contractor shall 
have staff available for consultation during normal business hours (8:30 AM to 5:00 PM) that 
accommodate all four time zones within the continental United States (refer to Task 1: 
ADMINISTRATIVE for options for active time zone coverage during normal business hours in the 
continental United States). The Contractor shail implement, maintain, and upgrade as necessary, 
telecommunication and electronic reporting systems to be available 24 hours-per-day (the toll-free 
telephone number is answered by machine after business honrs). After-hours automated support shall be 
available 24 hours-per-day throngh the web and fax. See Emergency Preparedness section for after-hours 
support details. Contractor staff shall respond to messages received at the VAERS telephone number and 
messages sent to the VAERS e-mail address within one business day of receipt. 


Staff the telephone system to provide telephone support for reporting during hours that accommodate 
normal business hours in the four time zones in the continental United States. The Contractor shall maintain 
a telephone voice message system, available at all times, which shail: 


1. Provide a mechanism for callers to contact VAERS toll-free by telephone; 


2. Provide coverage by automated menu choices for those times when Contractor staff does not 
immediately respond to calls to the telephone system; 


3. Provide instructions to callers on ways to obtain the VAERS form and instructions on how to submit a 
VAERS report; 


4. Provide directions to find the VAERS website and to submit a VAERS report using the internet-based 
reporting form; 


5. Take messages at those times the telephone system is not actively staffed; 


6. Provide information on the National Vaccine Injury Compensation Program (VICP) (website 
information: www.hrsa.gov/vaccinecompensation); 


7. Provide additional information to callers as directed by the Government. 


Maintain a United States Postal Service post office box identified as Vaccine Adverse Event Reporting 
System (VAERS) for SARS-CoV-2 vaccines and ensure, at a minimum, retrieval and logging of all mail 
from the post office box during each business day. 


Maintain VAERS for SARS-Co¥-2 vaccine electronic internet-based reporting system, utilizing 
appropriate system securily precautions. This includes reports submitted by VAERS nsers such as state 
health coordinators, immunization programs, other Federal Government agencies and programs, and other 
parties. The procedures shali include methods for receipt of reports via the Internet and shail allow for 
reporters to submit an initial WAERS report for SARS-CoV-2 vaccines or a non-primary report using an 
Internet-based application, including an electronic version of the VAERS form for SARS-CoV-2 vaccines. 


Maintain procedures to migrate data from VAERS SARS-Co¥V-2 vaccine manufacturer reports received 
electronically into the database, utilizing appropriate system security precautions. Manufacturer reports 
that must be received electronically include -marketing expedited individual case safety reports (ICSRs}, 
periodic ICSRs, as well as maifunction reports and 5-day reports required by the Combination product 
Post-market Safety Reporting Rule. Electronic manufacturer reporting using ICH E2B (R3) is referred to 
as eVAERS. 
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F. All methods for electronic transmission of reports developed and maintained for this project shall be based 
upon the HL7/ISO 27953-2 specification available at: 
http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=53825, the ICH 
E2B(R3) Implementation Guide available at: http://www.ich.org/products/electronic-standards.html, the 
FDA E2B(R3) Implementation Technical Specification that will be available on CBER’s ICSR website at: 
https://www.fda.gov/industry/about-esg/cber-vaccine-icsr-implementation , or other formats as specified by 


the Government. 


G. Develop, document and implement procedures for the entry and processing of SARS-CoV-2 vaccine report 
data to ensure that the VAERS public data that is made available to the public is redacted of all protected 
health information (PHI) and other information that is protected under the Health Insurance Portability and 
Accountability Act (HIPAA) (http://www.hhs.gov/ocr/privacy/), or otherwise not publicly releasable for 
reasons of commercial confidentiality (as directed by the Government), regardless of the report source 
(paper/fax/other, web, e-report). Government users of VAERS SARS-CoV-2 vaccine data shall have 
access to personal identifiers from the specific fields for names, addresses, telephone numbers, etc. throngh 
the internet-based report viewing system created and maintained by the Contractor. Such data containing 
PHI shail be included at the direction of the Government in the Government Extract for the CDC, FDA or 
both. 


H. Maintain a methodology to permanently archive electronically submitted VAERS SARS-CoV-2 vaccine 
reports as originally submitted, prior to any editing or redaction. The method shall allow for identification 
and retrieval of the reports from the archive database by specific report identifiers and by organization 
source of origin for reports submitted by manufacturers, state health coordinators, immunization programs, 
other Federal Government agencies and programs, and other parties. 


I. Maintain methods to support a variety of Electronic Data Interchange (EDI) message types specified by the 
Government. The Contractor shall have the capability to both receive and transmit VAERS SARS-CoV-2 
vaccine reports electronically in EDI formats specified by the Government and in additional electronic 
report submission formats consistent with electronic submission requirements based upon the HL7/ISO 
27953-2 specification available at: 

http://www.iso.org/iso/iso_catalogue/catalogue_tc/catalogue_detail.htm?csnumber=53825, the ICH 

E2B(R3) Implementation Guide available at: http://www. ich.org/products/electronic-standards.html, the 

FDA E2B(R3) Implementation Technical Specification that will be available on CBER’s ICSR website at: 

https://www.fda.gov/industry/about-esg/cber-vaccine-icsr-implementation, and other formats specified by 


the Government. 


J. Under the direction and approval of the Government, the Contractor shali support additional EDI interface 
products for VAERS users. These include products from other vendors that use the VAERS web-reporting 
form, commercial off-the-shelf products, and other products as they are developed. An EDI interface 
product has been developed, ntilizing the VAERS internet-based electronic submission form as a means for 
EDI electronic submission of VAEs by VAERS users from their immunizations databases. The Contractor 
shall successfully complete this task for existing, supported EDI interface products within 30 days after 
contract award. The contractor shail successfully complete this task for new EDI interface prodnets of this 
nature within 30 days following direction from Government to perforin this task. 


STANDARDIZED METHODS FOR ENTERING AND PROCESSING VAERS SARS-CoV-2 VACCINE REPORTS 
A. Report Data Entry and Processing Timeline Requirements: 


The Contractor shall perform all necessary data entry for information submitted on YAERS forms for 
SARS-CoV-2 vaccine reports and related documents, and editing of the database, with all entry and edits 
tracked by date and entry staff and editors’ individual identification. The Contractor shall be able to 
perform these activities within 30 days after contract award. See Appendix A (also in the section under 
Task 3) for information on scanning, data entry and coding timelines. 
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The timeline requirements for processing reports for VAEs of special interest to the Government (e.g., seizure) may 
differ from the above requirements and will be determined or otherwise agreed upon in SOPs approved by the 
Government. Timelines will be adjusted in response to changing public health needs, such as during a public health 
emergency or if a vaccine recommendation changes {e.g., a vaccine that was not previously recommended for 
children becomes recommended). 


B. Documentation, SOPs, and user procedure manuals: 


The Contractor shall perform the following tasks/activities related to adverse events reported after SARS- 
Co¥V-2 vaccines: 


1. Maintain and update comprehensive documentation of database structure; design and analysis, 
including dictionaries, edits, report processing, and computer programs (including menu driven 
programs); user procedure manuals; and other tasks and functions and any modifications set forth in 
this SOW. Documentation shall adhere to the standards set forth elsewhere within this statement of 
work, to include Capability Maturity Model (CMM) standards. 


2. Provide user-procedure manual(s) and SOP manuals for technical aspects of VAERS SARS-CoV-2 
vaccine database operations to the Government within 30 days after contract award. Implementation 
of ail procedures is contingent on Government review and approval. 


3. Maintain, update and provide to the Government as requested complete documentation of the SARS- 
CoV-2 vaccines database and ail regularly produced extracts. The documentation shall be readily 
available to the Government for use or reference and include data dictionaries for the datasets 
(including variable names, formats, descriptions, comprehensive list of legal codes) versions of the 
Medical Dictionary for Regulatory Activities (MedDRA) terms, (www.medramsso.com) or other 
coding language chosen by the Government, and look-up tables for vaccine, manufacturer, and 
MedDRA terms. 


4. Maintain full, detailed documentation for all business and technical aspects of the VAERS SARS- 
CoV-2 vaccine program. Documentation shall be updated annually or as requested by the 
Government, and maintained in two separate volumes: “Volume 1 — YAERS Business Processes” and 
“Volume 2 - VAERS IT Requirements and Design” as detailed in the Administrative section of this 
SOW. 


5. Maintain a formal “requirements” database, to be prioritized by a “change request board” consisting of 
CDC, FDA and Contractor personnel. Work shall be prioritized by this process, in both a routine and 
expedited manner as appropriate to the requirement. 


ACKNOWLEDGMENT, VERIFICATION, CODING AND DATA COLLECTION FOR ADVERSE EVENTS 
REPORTED AFTER SARS-CoV-2 VACCINES 
The Contractor shall perform the following tasks/activilies: 


A. Review all documents received daily through all channels to prioritize processing, and assign a unigue 
index number to each report received and initiate processing based on SOPS for the report category and 
method of transmission. The unique index number (VAERS ID number) shall appear in the personal data 
files and in files created for other information. 


For electronically submitted reports and reports submitted using the internet-based reporting application, a 
unique index Electronic Report Number (ERN) shall be generated at the time the report is received, and 
shall be communicated back to the originator of the report using a formal acknowledgement or EDI 
submission confirmation message integrating the E-Report Number into the message. The ERN shall be 
included in the primary system database and in the Government extract, and in relational data tables 
providing linkage between the ERN and VAERS ID number assigned to each report and may be used to 
query the VAERS report in the mnaster database and Government extract. For electronically submitted EDI 
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reports, sufficient information shall be retained from the EDI VAE message to uniquely identify the report and 
enable tracking and identification of the report within the primary system database. 


Enter into the database all data submitted on report forms and related documents within the time limits 
specified in this SOW. 


Code VAE data after SARS-CoV-2 vaccines on the VAERS report form (paper or electronic form/data), from 
related documents/records, and from additional information sources related to the report (i.e., records obtained 
during follow-up) using the most updated version of MedDRA (hitp://www.meddra.org/) or other coding source 
specified by the Government. Codes shall be entered into the database. Relational tables and data dictionaries 
shall be provided to the Government for all coding used throughout the system. The Government reserves the 
right to update and replace coding standards as required for the data elements, and reserves the right to 
introduce requirements for standardized coding for data elements not included in this SOW. 


The Contractor shall enter into the database SARS-CoV-2 vaccine VAE descriptive clinical information and 
other symptoms, signs, lab data and/or disease entities, including text fields contained in Boxes 9, 10 11, 12, 
18, and 19 on the VAERS reporting form (Available at https://vaers.hhs.gov/uploadFile/index.jsp) and code 
this information usmg MedDRA (or other coding language chosen by the Government). The specific boxes 
may change if the VAERS form is modified. 


2. At the direction of the Government, the Contractor shall assess and potentially implement alternative 


methods for coding reports (computer assisted, automated, algorithm generated, etc.), and conduct post- 
implementation quality assurance. The implementation of alternative coding methods is dependent on the 
availability of core and supplemental funding to support such activities. 


At the direction of the Government, the Contractor shall prioritize the processing and coding of reports per 
the Government’s preference (to include prioritizing report processing by manufacturer or product type 
and time-limited pre-processing of selected reports for early screening for selected conditions). Based on 
the volume of prospective reports and Contractor progress on clearing the backlog of existing reports, the 
Government shall periodically reassess prioritization and processes for report processing and provide 
additional direction if necessary. Upon award of this contract modification, the Contractor shall prioritize 
and process reports per guidance in 3a, 3b, 3c, and 3d below, until directed otherwise by the Government. 
Changes in the Government’s guidance for report processing may be incremental depending on volume of 
prospective reports and progress with clearing the backlog of reports. 


a. Process and enter into the VAERS database as quickly as possible any backlogged and 
prospective manufacturer reports that are already MedDRA coded by the manufacturers without 
any additional coding by the contractor. This means that all manufacturer reports would bypass 
Contractor MedDRA coding and the codes submitted with the original manufacturer report 
would be utilized. These reports will become part of a ‘virtual’ backlog that will be coded/re- 
coded and reviewed for quality assurance by the Contractor as part of the backlog clearance 
process prior to the end of each Period of Performance. The Contractor shall make system 
modifications to complete this task, as necessary. 


b. The Contractor shall prioritize processing electronic reports over mailed paper, faxed, and 
emailed reports (which need to be manually entered into the database). This means that electronic 
reports would be processed preferentially over mailed paper, faxed, and emailed reports, which 
would be processed only after the electronic report backlog and prospective electronic reports 
have been processed. The mailed paper, faxed, and emailed reports would be scanned into the 
system and/or securely stored until they are processed. The Contractor shall make system 
modifications to complete this task, as necessary. 


c. Consistent with the general guidance for 3a and 3b, the Contractor shall prioritize report 
processing for both the backlog and prospective reports in the following order: 1) U.S. death 
reports, 2) U.S. non-death serious reports, 3) U.S. non-serious reports, 4) foreign death reports, 5} 
foreign non-death serious reports, 6) foreign non-serious reports. The Contractor shall make 
systern modifications to complete this task, as necessary. 


d. The contractor shall only perforin one pass and a senior review for serious reports including 
death reports for both data entry and MedDRA coding. This shall reduce the two pass data 
entry/coding performed for death and serious reports to one pass only. This shali not eliminate 
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Comply with the safeguarding procedures for report forms as required by the NCVIA — 42 U.S.C. 300aa- 25, 
and the safeguarding guidelines of the Privacy Act. The Contractor shall ensure that information which could 
identify an individual (such as name, street address, telephone number and email address of the person who 
received the vaccine and that person’s legal representative) shall not be made available to any person other than 
the person who received the vaccine or the legal representative of such person and duly authorized staff of 
CDC, FDA and other participating federal entities. The restriction on access to identifying information applies 
to all information received by the VAERS activity, regardless of physical format (paper, electronic, other). The 
process shall be subject to review and approval by the Government. 


Maintain storage of original and depersonalized data separately. Records shall be maintained in accordance with 
Privacy Act regulations and procedures and defined in the Automated Information Systems Security Program 
Handbook. Separate physical and electronic storage of original and redacted report data shall be maintained. 


DATA AND DOCUMENT ACCESS, TRANSMISSION, STORAGE AND RETRIEVAL 


(See Appendix A for detailed information on scanning, data entry and coding timelines). 
The Contractor shall perform the following tasks/functions: 


A. Maintain procedures to complete processing of death, 5-day, 15-day, serious, or other priority reports as 
specified in Appendix A, or upon request of the Government. 


B. Make available to the Government an electronic copy of all received documents within the specified 
timeframes detailed in Appendix A. The Contractor system (currently a virtual private network 
[VPN] containing scanned images) enables Government staff electronic access to reports/documents 
while preserving the integrity of the original document. 


C. Scanned reports and other documents that the Contractor makes available to the Government on the 
YPN do not require redaction unless specified by the Government. 


D. Provide a data extract (Government Extract) of the VAERS SARS-CoV-2 vaccine data to the 
Government for storage and use at Government sites (both CDC and FDA) each business day, in 
accordance with this SOW. 


E. Redact all PHI from reports to the YAERS database after SARS-CoV-2 vaccines that appear anywhere 
on the VAERS report form except boxes specifically asking for PHI. For example, if Box 18 on the 
VAERS 
2.0 form states “I gave Mr. Jones his flu shot and then he had a reaction,” the words “Mr. Jones” should be 
redacted from the VAERS database. 


CHANGES TO REPORT RECIEP? AND PROCESSING 


A. All tasks and activities specified in this SOW that pertain VAERS report receipt and processing are 
subject to change, at the Government’s discretion. 
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B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated report receipt and processing procedures and 
the Contractor will be aliowed to negotiate implementation of changes. 


TASK 3: VAERS FOLLOW-UP ACTIVITIES AND ENHANCED SURVEILLANCE 
The Contractor shall conduct follow-up on VAERS SARS-Co¥V-2 vaccine reports as specified by the Government in 
this SOW. Follow-up consists of the 3 parts outlined below: 

e Communication Activities and Automated Record Collection 

e Record Collection and Data Clarification 

e = Clinical Activities 


COMMUNICATION ACTIVITIES AND AUTOMATED RECORD COLLECTION FOR VAERS SARS-CoV-2 
VACCINE REPORTS 
The Contractor shall: 


A. Upon receipt of a death report from a family member, provide a condolence letter to express sympathy 
and explain YAERS procedures. 


B. Provide immediate electronic acknowledgement to all persons who submitted VAERS reports via 
the Internet using the online reporting tool. 


C. Provide acknowledgement in the form of a thank-you notification to all persons who submitted 
VAERS reports via paper format. Exceptions to this requirement are family members who report 
deaths, all manufacturers, and all state health coordinator reporters. 


D. Develop and implement standardized letters, forms, logs, phone scripts and other documents, subject 
to approval by the Government, and implement documents developed by the Government at the 
direction of the Government, in order to verify the accuracy of submitted data. 


E. Maintain procedures to request additional information from reporters or providers if information from 
essential items (2-6, 17, 18, and 21) on the initial VAERS report are missing, inconsistent or invalid. 
(See https://vaers.hhs.gov/pdf/vaers_form.pdf). Essential item numbers are subject to change if the 
VAERS form is altered or updated by the Governinent. 


F. Maintain procedures to request disposition updates from reporters at 60 days and | year after report 
receipt for al] serious reports with recovery status listed as not recovered. Include a request for any 
additional information. No 60-day update is required if routine follow-up has been conducted on the 
report. 


RECORD COLLECTION AND DATA CLARIFICATION FOR SARS-CoV-2 VACCINE REPORTS 


A. For all domestic SARS-Co¥-2 vaccine reports designated as serious by regulatory definition (death, 
life-threatening illness, hospitalization, prolongation of existing hospital stay, permanent disability, or 
congenital anomaly/birth defect), the Contractor shall attempt to collect follow-up records and 
additional documentation of the event (includes clarification of the event if necessary). In addition, for 
other adverse events of importance as determined by the Government, the Contractor shall attempt to 
collect follow-up records and additional documentation of the event. Follow-up activities include: 


1. Identification and resolution of conflicting or incorrect information in the VAERS database 
and annotation in the VAERS graphic image file. 


2. Retrieval of pertinent medica! records including hospital discharge summary, labs, history and 
physical reports, medical, death certificates and/or autopsy reports. In addition, if the vaccination 
information is missing or unclear (e.g., a report states “flu vaccine” but the brand or manufacturer 
name is missing) the vaccination record shall be obtained. 


3. Scanning of all collected documents/records into the VAERS image base. 
4. Other follow-up activities as directed by the Government. 
Upon award of the contract, the Government will provide detailed, standard procedures for follow-up, which 


are subject to change based on the needs of the Government. See Appendix A for required timeframes for 
follow-up. YAERS correspondence can he via email or hardcopy letters. 
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Report Confirmation for SARS-CoV-2 Vaccine Reports 


Confirmation correspondence is sent on receipt of a VAERS SARS-CoY-2 vaccine report submitted by a 
consumer or healthcare professional. Hardcopy letters or email correspondence are sent, depending on the 
person’s communications preferences (specified in the VAERS report). Vaccine manufacturers do not receive 
these communications. 


REPORT TYPE FOLLOW-UP CORRESPONDENCE TYPE 


STANDARD - NO MISSING Send letter or email Confirmation* 

emit fee ees eal 
STANDARD -INFORMATION Send letter or email Confirmation with request for missing 
SERIOUS WITH “NO” FOR Send letter or email 60 day follow-up and one year follow- 
DEATH REPORTS FROM Send letter only Condolence letter; consumers only* 


*The Government will provide the format and wording of the letters for the contractor's use 


Medical Record Requests for SARS-CoV-2 Vaccine Reports 


Requests for medical records are sent in follow-up* toa VAERS SARS-CoV-2 vaccine report. 


REPORT TYPE FOLLOW-UP CORRESPONDENCE TYPE 


SERIOUS-NON FLU VACCINE Send request for medical records | Request for medical records** 
letter” 

SERIOUS FLU VACCINE Send request for medical records | Request for medical records for flu 
for flu vaccine reports letter* vaccine reports** 


NON SERIOUS REPORTS OF Send request for medical records Request for medical records** 
SPECIAL INTEREST letter* 


DEATH Send request for death certificate | Request for death certificate** 
letter 


FOREIGN None 


MANUFACTURER REPORTS None except death or if requested 
by the Government (of special 
interest). 


CLINICAL TRIALS 


*The Government will provide a guidance document to specify what records the contractor needs to obtain. 
**The Government will provide the format and wording of the letters for the contractor's 


use CLINICAL ACTIVITIES FOR SARS-CoV-2 VACCINE REPORTS 


A. Clinical staff shail review follow-up records and add a narrative summary to the Government data for 
each report to reflect follow-up records collected. If records are not available, clinical staff may need to 
contact providers or patients to obtain follow-up information. For example, if a patient reports a serious 
adverse event but does not seek medical care, the patient or parent would need to be called to obtain the 
details and outcome of the event. 


B. Clinical staff shall add appropriate MedDRA codes to the record to reflect data from the follow-up. An 
indicator variable will be provided to distinguish between initial and follow-up MedDRA codes, as well 
as, item number on the VAERS form. 


C. Clinical staff shall edit or supplement as needed the relevant VAERS database record based on 
documents collected in follow-up (e.g., if the vaccine records differ from what is on the YAERS report, 
the vaccine information shall be corrected in the VAERS data). 


D. Clinical staff shall complete Government-developed forms for specific reports which are intended to 
obtain supplemental information as directed by the Government. 
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E. Clinical staff are expected to pursue any leads that become apparent during the follow-up process and 
obtain information beyond what is detailed on any standard questionnaire that may contribute to an 
understanding of the underlying cause(s) of the adverse event in question. The information obtained from 
these leads shall be documented in narrative format by the foilow-up staff. For example, if during follow- 
up the clinician learns that the patient had to be readmitted to the hospital, those records shonld be obtained 
and summarized in addition to the initial hospital admission records. 


F. Information obtained dnring follow-up shall be clearly separated from information in the VAERS report 
when entering follow-up data into the VAERS database. The Government will provide instructions on 
how this will be accomplished. Follow-up information will NOT be included in the VAERS public data. 


G. When unexpected, significant, or unusual findings are identified during the performance of follow-up 
activities, findings shall be shared with FDA and CDC VAERS staff as determined by the professional 
judgment of the clinical staff. 


H. Clinical staff shali stay current on vaccine recommendations and VAEs. A useful resource is the Advisory 
Committee on Immunization Practices website: https://www.cdc.gov/vaccines/hcp/acip-recs/index.html 


l. Provide an indicator variable in the database that will specify if the medical records were collected and the 
type of records obtained. 


TASK 4: QUALITY CONTROL FOR VAERS SARS-CoV-2 VACCINE DATA 

The Contractor shall develop and implement a Quality Assurance Program (QAP). The QAP is applicable to all 
functional areas of this SOW and will allow the Government to verify that contract performance objectives are met, 
the best possible contract performance is being provided, and there is continuous improvement in the quality of 
contract services. The QAP is an important tool for using and monitoring performance indicators and ensuring the 
achievement of desired performance measure outcomes. The QAP shall establish quantitative evaluation strategies 
to ensnre that contract performance measurements meet or exceed the highest levels of service. 


The Contractor shall work with the Contracting Officer (CO) and Contracting Officer's Representative (COR) to 
develop standardized tools for assessing contract/project activities and provide consistent evaluation scoring. The 
Contractor shall conduct self-assessment and evaluation quarterly through the QAP and other strategies and 
methodologies to ensure quality performance of contract activities. 


The QAP shall establish quantitative evaluation strategies to ensure compliance to the contract performance 
measurements and meet or exceed the highest levels of service. The plan should specify who within the 
Contractor’s organization has oversight for quality initiatives. The Contractor shall provide this plan to the 
Government within 30 days after contract award. The plan should be updated as necessary {at a minimum annually) 
or as instructed by the Government to ensure that it remains current. 


Quality control procedures shall be developed and implemented, subject to review and approval by the COR, for 
submitted data, entered data, scanned images, follow-up data and coded data. The areas to be addressed shall 
include completeness and accuracy of data, recovery status, follow-up, timelines of report processing for serious 
reports, unexpected occurrences (e.g., pandemic influenza, new recommendations), and completeness and accuracy 
of vaccine lot information on all VAERS SARS-Co¥V-2 vaccine reports. 


QUALITY CONTROL AND ASSURANCE FOR ENTERED AND PROCESSED DATA FOR SARS-CoV-2 VACCINE 
REPORTS 


A. The Contractor shall establish, implement, update and maintain standardized methods for confirming the 
quality of processed data through standardized quality contro] and quality assurance procedures designed to 
reduce or eliminate duplicate entries, data inconsistencies or deficiencies. 


B. Subject to Government approval, the Contractor shall develop, demonstrate, document, and implement 
procedures to maintain data quality at a level adequate to support data analysis. The procedures shall 
include: 


1. Automated editing procedures for data entered by the contractor using the Contractor’s internal data 
entry system, including double-entry verification of entered data for select fields in reports as specified 
by this SOW. 
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rs Automated spelling checks for all text fields on the forins that undergo data entry by the contractor 
using the Contractor’s internal data entry system. Automated spelling check functions shall include 
standard and custom dictionary spell check, including abbreviations and medical terminology. This 
process shall detect and alert the operator to possible spelling errors at the time of data entry, so that the 
operator can immediately implement appropriate corrections. 


3 Incorporation of appropriate field restrictions, legal value checks, and background logic checks in the 
data entry software to ensure that the entered information is logical and appropriate before it is accepted. 
These procedures shall include, but will not be limited to, the following edit-checks listed below : 


a. Keystroke edit checks to ensure only correct values for the field are accepted. All other values 
cause the system to post an error/warning message. 


b. Within-field checks to ensure that data are valid for that field (e.g., entering numbers in a Name field 
is invalid and shall be flagged in error/waming). In addition, unusual values in fields, for example: 1} 
adverse event onset date before vaccination; 2) interval between vaccination date and onset date 
greater than 10 years, shall be flagged. 


c. Cross-field checks to ensnre that information does not conflict with previously entered data {e.g., a 
death date is invalid if it is entered with a valne prior to the date of birth or vaccination date/onset date 
prior to date of birth). 


All edit checks procedures shall have the ability to be modified as needed. The data entry system shall 
display warnings or error messages when unusual or incorrect information is entered for new records or for 
existing records which are retrieved and updated. 


4. Automated spelling checks and edit-checks, as described above, used on the web data entry system and 
implemented in a manner that does not impede or significantly increase form completion time by users. 


5. Development, implementation, utilization, documentation and reporting of internally calculated variables 
to define the quality of the data records entered. These variables shail be made available to the 
Government and shali be utilized in quality assurance programs and assessments by the Contractor and by 
the Government. 


6. Establishment of an edit program that outputs missing and non-plausible data for visual verification 
with the corresponding VAERS form image record. 


7. Establishment and implementation of a mechanism for correcting data errors detected in the previous 
steps. 


8. Review of ali data on a quarterly basis to examine frequencies of categorical] fields and the distribution 
qualities of continuous variables for any non-plausible data, and verification of any non-plausible data 
indicated in this step. 


a. Establishment and implementation of a mechanism for data corrections indicated in the above 
review processes. 


The Contractor shall perform double data entry on all US serious SARS-CoV-2 vaccine reports and other 
reports as specified by the Government. The verification process shal] include data entry into two independent 
data files by different personnel unless otherwise approved by the Government. Report entries shall be matched 
by identification number and discrepancies shall be resolved. Target permissible data entry effort rates shali be 
subject to review and approval by the Government. If the Government identifies significant data entry quality 
concerns, then the requirement for double-data shall be increased to include all reports received until further 
notice from the Government. 


D. All data entry procedures shail include real-time automated checks for illogical date relationships, invalid 
vaccine types, unavailable vaccines, invalid vaccine manufacturer combinations, invalid manufacturer or 
lot number, and other invalid data element combinations. Documentation of programming of these edit 
checks shall be submitted to the Government upon request. The data entry process shall be configured so 
initial data entry of records cannot be completed until all flagged data have been accepted as corrected or 
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moved to a queue for subsequent follow-up within one week. These later stages could include, at the 
discretion of the Government: 


1. Addition of a module for acknowledgement letters sent to individual reporters to request clarification 
of missing or erroneous data; and 


2. Referral of records to follow-up staff as described in the Follow-Up Section in this SOW for correction 
or completion of missing or erroneous data through follow-up activities. 


E. The Contractor shall maintain and update a list of currently available SARS-Cov-2 vaccines during the 
contract period. 


F. The Contractor shall maintain within the Relational Database Management System (RDBMS), a log of ail 
manual edits of processed data, including deleted files, with date, editor, and nature of edit identified. All 
data contained in files deleted from the database shal] be moved to a separate data set that shall remain 
available for review and retrieval. 


G. Any errors identified by the Contractor QA checks or Government shall be corrected in the database. 


QUALITY CONTROL AND ASSURANCE FOR SUBMITTED DATA QUALITY FOR SARS-CoV-2 VACCINE 
REPORTS 


A. The Contractor shall develop, demonstrate, document, and implement mechanisms to detect and request 
missing or discrepant data from the reporter. The requests shall be made in the form of report 
acknowledgment letters or other methods at the direction of or with the approval of the Government and 
shali present incomplete data fields and discrepant data for review and completion or correction by the 
reporter. 


B. The Contractor shall develop, demonstrate, document and implement mechanisms to detect, confirm, and 
link duplicate or redundant VAERS SARS-CoV-2 vaccine reports concerning the same adverse event. 
These mechanisms will be implemenied as follows: 


1. Initial data entry duplication search based on several key identifiers (e.g. name, date of birth, sex, 
vaccination date} 


ta 


Two times per week {or as specified by the Government) data entry duplication search on key 
identifiers, and adverse event. An adverse event is defined as a single “person vaccination event” or the 
combination of a patient, reported vaccine(s), and adverse event(s), submitted by one or more 
reporters. 


The following business rules and definitions shall apply to this activity: 


a. The first SARS-CoV-2 vaccine report received by VAERS for a given adverse event shail be 
defined as the Primary Report. Other reports received after the Primary Report has been received 
and processed by the system shall be defined as Secondary Reports. 


b. Any SARS-CoV-2 vaccine reports received by VAERS after the Primary Report has been 
received, which are exact duplicates (photocopies or identical! printouts or identical web based 
reports) of the Primary Report, shal! be defined as Exact Duplicate Reports. These Exact 
Duplicate Reports shall be destroyed upon recognition. 


c. Any SARS-CoV-2 vaccine reports received by VAERS after the Primary Report has been 
received, which relate to the same “person vaccination event”, but which are not exact duplicates 
of the Primary Report, shall be defined as Redundant Reports. Redundant reports may originate 
from different reporters reporting the same “person vaccination event”, or may originate from the 
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same reporter as the Primary Report, or may provide different information about the adverse 
event, including information updates. 


d. All SARS-Co¥-2 vaccine reports that relate to the same “person vaccination event” shall be 
grouped together based on the VAERS ID for the Primary Report. 


e. The manner of identifying the Primary SARS-CoV-2 vaccine Report and all subsequent 
(Secondary) reports shall be as follows, unless otherwise indicated by the Government. The 
Primary Report shall have the VAERS ID assigned at the time the report is entered into the 
system, followed by the identifier “-1”. The first subsequent VAERS report concerning the same 
“person vaccination event” shall be assigned a “Linked Report” VAERS ID, which shall be the 
VAERS ID for the Primary Report, followed by the identifier “-2”, at the time the report is 
identified as a redundant report. The second subsequent VAERS report concerning the same 
“person vaccination event” shall be assigned a VAERS ID, which shall be the VAERS ID for the 
Primary Report, followed by the identifier “-3”, at the time the report is identified as a redundant 
report. Subsequent redundant reports shall continue to be numbered according to this pattern. The 
identifier digit following the hyphen shall be known as the “order number”. 


f. Assigning status regarding the serious nature {Item 21) on the VAERS form: death, life 
threatening illness, emergency room/department or urgent care visit, , hospitalization, prolongation 
of existing hospitalization, disability or permanent damage, congenital anomaly or birth defect, 
doctor or other health care professional office visit, none of the above) of the “person vaccination 
event” reported, as defined in 21 CFR 600.80, shall be based on the highest degree of severity for 
any of the reports received for a specific “person vaccination event”. The report with the highest 
degree of severity shall take precedence in the determination of serious/non-serious status if 
discrepancies exist between the original report and subsequent reports. If there is uncertainty 
regarding a report’s status as being serious or non-serious, reports should generally be adjudicated 
in favor of serious status. 


As required, the Contractor shall develop, demonstrate, document, and implement a methodology by which 
data submitted by multiple reporters, in multiple documents from the same reporter, or obtained through 
follow-up or verification activities regarding the same event, are combined to create a composite table or 
tables which include the reconciliation of conflicting information through follow-up with the reporter, 
health care provider or parent/vaccine recipient. The Contractor shall amend the primary report with 
information from subsequent multiple reports on the same adverse event (“person vaccination event”), 
based on the accuracy of the information (e.g. medical records, follow-up information) or Government 
approval. 


When a YAERS SARS-CoV-2 vaccine report is identified as being a Redundant Report or Duplicate 
Report and has been reassigned a VAERS report identification number based on the VAERS ID for the 
Primary Report with appropriate identifier tag (e.g., VAERS ID = 123456-2), the Contractor shall retain the 
VAERS ID number which has been replaced (referred to here as “Old VAERS ID”) for the specific report 
in an accessible file for mapping to the current VAERS ID. 


The Old YAERS ID shall be retained in a data table linked to the primary YAERS database to allow for the 
search and identification of any specific VAERS report by either the first VAERS ID assigned (the Primary 
Report ID until a report is identified as Duplicate or Redundant) or subsequently reassigned Linked Report 
ID. 


The Contractor shall develop, demonstrate, document, and implement a coding variable (Patient Continuity 
Code) which shall be used to link a patient identified in a report to other reports in which that particular 
patient has been identified. Such reports may include Redundant and Duplicate Reports but may also 
include different “person vaccination events” regarding the same person, but a different vaccination and/or 
event. The Patient Continuity Code shail be included in the primary system database and in the 
Government Extract. 
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The Contractor shall develop, demonstrate, document, and implement measures for batch-matching to 
identify redundant or secondary reports. The Contractor shall evaluate a variety of methods including 
“fuzzy logic”(http://en. wikipedia.org/wiki/Fuzzy logic) for identifying possible duplicate or redundant 
reports, including reports linked with minor name variations, and implement them at the Government’s 
discretion. An example of the use of fuzzy logic would be linking two different VAERS reports of a very 
rare occurrence in two patients who have the same birthdate and same date of vaccination but no name 
reported, into one VAERS report if the Contractor believes the two reports pertain to the same patient. 


The Contractor shall develop and maintain methods for confirming the quality of submitted data through 
standardized quality control and quality assurance procedures designed to reduce or eliminate the presence 
of more than one record concerning the same adverse event, data inconsistencies or deficiencies. 


K. Any errors identified by the Contractor QA checks or Government should be corrected in the data. 


QUALITY CONTROL AND ASSURANCE FOR SCANNED DATA QUALITY FOR SARS-CoV-2 VACCINE 
REPORTS 


A. The Contractor shall develop and maintain methods for assuring the quality of document images for the 


B. 


image database and correct indexing in the image database through standardized quality control and quality 
assurance procedures designed to confirm that documents are as legible as possible, complete, and capable 
of retrieval and copying from image base prior to final transfer of original physical document to the 
Government for archiving. 


Any errors identified by the Contractor QA checks or Government should be corrected in the data. 


QUALITY CONTROL AND ASSURANCE FOR CODED DATA QUALITY FOR SARS-CoV-2 VACCINE REPORTS 


The Contractor shall develop and implement a training program for all data entry and coding staff which 
shall require approval by the Government. The Contractor shall enforce a certification process that requires 
all coders to be trained and become certified coders for current code-based data. This shall include 
MedDRA, or another coding system chosen by the Government. The data system shall include a coder- 
signature field to indicate the specific coder staff person who performed the report coding. 


The Contractor shall develop or procure and use automated tools, such as auto-coding software, algorithms 
and aides, when available and approved by the Government, to assist in the coding process. 


The Contractor shal! provide online manuals for coders to use at any time so that coders can access 
simulated scenarios and glean applicable codes. 
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E. The Contractor shall document any non-standard coding values in use by the VAERS program and 
submitted in reports. 


F. The Contractor shall implement QA procedures and reviews to ensure that data provided as part of 
Government data extracts meet pre-specified requirements as directed by the Government. Procedures for 
data entry error identification, correction and supplemental data entry should be established by the 
contractor in advance of any error detection by the Government. 


G. The Contractor shall develop and implement a QAP which shall include performance quality measures for 
each of the elements in this section of the SOW, and which shall require approval by the COR prior to 
implementation. The Contractor shall perform evaluation of these performance quality measures and report 
the results to the Government annually or on an alternate schednle as specified by the Government and 
propose procedure modifications as necessary to ensure data quality. The resultant modifications to QA 
procedures shall be periodically implemented contingent upon approval by the COR or CO. 


H. Any errors identified by the Contractor QA checks or Government shall be corrected in the data. 


QUALITY CONTROL UPDATES FOR SARS-CoV-2 VACCINE REPORTS 


A. The Government reserves the right to direct the Contractor to revise and update QA procedures in the QAP 
to support changes in reporting procedures, such as changes to the VAERS form, online reporting tool, or 
standard methods of reporting {i.e., transitioning to fully electronic reporting). 


B. Reasonable accommodations will be made to the Contractor by the Government to allow for 
implementation of any such revised and updated QA procedures and the Contractor will be allowed to 
negotiate implementation of changes. 


TASK 5: INFORMATION MANAGEMENT FOR SARS-CoV-2 VACCINE REPORTS 


A. VAERS is an integrated system that encompasses information technology, data management, data 
analysis, software development lifecycle and IT secnrity. The Contractor shail perform the following 
tasks/activities: 


1. Maintain Capability Maturity Model (CMM) Level 3 certification or higher throughout the 
performance period of the contract and provide the Government current documentation of its CMM 
Level 3 or higher certification. 


ma 


Maintain current system operations 

3. Provide software development, enhancement and progress reviews as requested by the Government. 

4. Provide software documentation inclusive but not limited to systems requirements, specifications, 
architecture details, design details, analytical algorithms, data models, and technical support processes. 
Ail documentation shal] be submitted to the Government in each annual report and during and 


following the implementation of system changes. 


5. Provide data extractions and depersonalized data sets requested by the Government on a routine and 
ad-hoc basis 


6. Provide ad hoc searches of VAERS SARS-CoV-2 vaccine data as requested by the Government 


7. Implement appropriate Government policies and regulatory requirements regarding information 
management, information technology, software development, and security. 
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B. The Contractor shall furnish all necessary personnel, facilities, supplies, and equipment, as appropriate, to 
provide the Government with required technical, and operational services, within the general work 
parameters set forth in this Statement of Work. 


VAERS SARS-CoV-2 SYSTEM SPECIFICATIONS 


A. The VAERS system shall be hosted on an offsite network consisting of CDC owned software, commercial 
off the shelf software (COTS), and owned and leased hardware. The VAERS Servers will be categorized 
into core, non-core and infrastructure systems. Core systems are those identified with core business 
functionality, non-core provides support for the core systems. The infrastructure servers will provide 
centralized security, network, authentication, storage, remote access and management of all the VAERS 
environments. These servers may consist of a combination of physical and virtual servers, though virtual 
servers are recommended. 


The VAERS architecture should consist of two separate Security Sockets Layer (SSL) virtual private 
networks (YPN), one contains the production and software development lifecycle (SDL) environment, and 
the second located offsite contains a disaster recovery environment. The disaster recovery site is a 
duplicate and replication of the production site and provides recovery of the production site within 24 hours 
(refer to Task 1; ADMINISTRATIVE for physical location requirements for the offsite environment for 
disaster recovery, Le., the disaster recovery site). 


Below is an example of the approximate number of development, testing and user acceptance servers 
needed for the system: 


| Environment | Physical | Virtual | 
[Infrastructure | FS 3 
| Production J 2] O5) 
| Disaster Recovery | 6] n) 


| Development | 0f 6] 


B. Software to be installed on these machines includes but is not limited to: 


Activator, ColdFusion, Apache, Biscom FAXCOM, CentOS Enterprise Linux, Chado Software, SpellText, 
Cisco ASA software, Cisco IOS, CopSSH, Doubletake, Express Metrix, Faxcom, HP Array Configuration 
Utility, IBM Rational Tools, Itefix CopSSH, Java, Jpeg Wizard, Kofax Capture, Macromedia CFMX, 
Medical/Pharmaceutical Spellchecker, Microsoft Active Directory, Microsoft Remote Desktop Version 10, 
Microsoft Windows server 2016, Microsoft IIS, MS Office, MS OS, Microsoft SQL 2017, Microsoft VSS, 
NSClient++, PHINMS, Python, rDist, Redhat Enterprise Linux, rSync, RSA Authentication Manager, RSA 
Radius Server, SAS, Screen, SourceForge GNUWin32, SpellText, Stedman’s spellchecker, Superflexible, 
Syinantec Backup Exec Agent, Symantic Antivirus, Tripwire for Servers, VMWARE, Zope 


Contractor must license or own software (or equivalent) as listed above. 


C. Contractor must develop a VAERS Virtual Private Networks (VPN) which allows authorized users located 
outside of the Contractor’s facility to establish a secure connection to the VAERS application. The 
VAERS VPNs will provide a secure computer network that uses the Internet to allow remote users secure 
access to the VAERS application and database. It should encapsulate data transfers each business day, 
between the authorized users and Contractor’s networked devices to keep transferred data private from 
other devices on one or more intervening local or wide area networks. Depending on the user’s access 
rights to the VAERS database, the individual will either be part of a VPN with ful! access to the VAERS 
database or a more restricted VPN only providing access to reports of selected research interest. The 
Contractor adheres to the following and is expected to create and maintain capabilities to perform these 
functions: 
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Conduct web based query 

Enable viewing of scanned images 

Enable viewing of entered data including Follow up and MedDRA code 
Enable viewing of nurse follow up module 


D. Other VAERS functionality requirements include: 


l. Creation of a VAERS SARS-CoV-2 vaccine public website and online reporting tool which 
includes a mechanisin for allowing patients, parents, providers and other partners and stakeholders 
to electronically subinit VAERS reports 


2. Creation of an intranet application that allows authorized staff to access SARS-CoV-2 vaccine 
reports to query, add and modify data, and view linked images 


3. Double data entry of specific report types as determined by the Government 


4. Scanning of hard copy documents including, but not limited to, VAERS SARS-CoV-2 vaccine 
report and medical documentation. 


5. Receipt of electronic SARS-Co¥V-2 vaccine reports from manufacturers (eVAERS) 


6. Electronic transmission of reports and data extractions to CDC and FDA as specified by the 
Government 


7. Business Intelligence 

8. Data warehousing 

9. Data editing 

10. Duplicate identification 

11. Database management system and tools 


12. Software for extracting and transmission of Government specified data sets. 


DATA MANAGEMENT 


A. All Information Technology (IT) systems must comply with federal regulations and policies regarding IT 


B. 


which includes but are not limited to Enterprise Performance Life Cycle (EPLC), Capital Planning and 
Investment Contro] (CPIC), Information Security, Section 508 of the Rehabilitation Act, Enterprise 
Architecture (EA), etc. 


These methods, procedures and processes will accept reports submitted by business partners including 
manufacturers, state health coordinators, and other immunization programs, other Federal Government 
agencies and programs, and other parties. 

Electronic manufacturer reports include post-marketing adverse drug reaction (ADR) data for individual 
cases, post-marketing expedited ADR reports and periodic ADR reports. Electronic manufacturer reports 
shall conform to the format and processes identified and implemented by the US Food and Drug 
Administration (FDA). This reporting process is referred to as eVAERS. 


Under the direction of the CO and COR, the Contractor shall establish and maintain methods, procedures 
and processes to support a variety of Electronic Data Interchange (EDI) message types to be specified by 
the Government. The contractor will work with SARS-CoV-2 vaccine manufacturers (approved by 
Government), to ensure electronic subinission of postmarket individual case safety reports (CSRs) to 
VAERS using E2B(R3) and submitting via xml format. Electronic reporting of vaccine postmarketing 
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safety reports shall follow the International Council on Harmonisation’s {ICH} E2B(R3) ICSR specification 
: hitps://www. federalregister.gov/documents/2014/06/10/2014-13480/postmarketing-safety-reports-for- 
human-drug-and-biological-products-electronic-submission 


STANDARDIZED METHODS FOR PROVIDING ROUTINE AND REQUESTED REPORTS OF VAERS SARS-CoV- 
2 VACCINE DATA TO THE GOVERNMENT 


A. The Contractor shall perform ad hoc searches of the VAERS SARS-COV-2 vaccines databases to address 
specific surveillance questions and support vaccine safety studies, as requested by the Government. 


B. At the direction of the Government the Contractor shall develop, maintain and update prograins to 
routinely produce specific depersonalized data sets containing originally reported information for the public 
websites, World Health Organization (WHO), state health coordinators and others as approved by the 
Government. 


C. The Contractor shall provide a weekly reports of adverse events after SARS-CoV-2 vaccines reported for 
specific jurisdictions via The Epidemic Information Exchange (Epi-X) to those specific State Health 
Coordinators as indicated by the Government, upon request by the Government. 


These reporting requirements are subject to change at the request of the government. 
GOVERNMENT DATA EXTRACTS FOR SARS-CoV-2 VACCINE REPORTS 


A. The quality of the data extract is important to VAERS, therefore, the Contractor shall provide accurate data 
extract (“Government Extract”) to the Government for storage and use at Government sites (both CDC and 
FDA). The data extract and all available data elements collected from the submission of VAERS reports 
and collected through follow-up activities are subject to the approval of the Government and should be 
provided according to the specified timeframes detailed in Appendix A. The complete VAERS SARS-Cov- 
2 vaccine database, containing both (a) all data elements from the VAERS form which include those data- 
elements historically used by the Government, and (b) any new and valuable data-elements added by the 
Contractor by the direction of the Government shall be provided daily. All data elements collected on the 
VAERS form (and subsequent approved revisions of the VAERS form), and subsequent data elements 
collected via internal entry system or web system, are subject for inclusion in the data extract to 
Government. If the data element is a specific field on the form, the data shall be stored in a related specific 
field in the Government data, with no concatenation of data fields or elements. The following are examples 
of two processes for important extracts of data from the VAERS system that the Contractor shall follow: 


1. VAERS SARS-CoV-2 VACCINE DAILY EXTRACT - Each business day, the Contractor shall send 
an extract to the CDC and FDA through a low cost data transmission application. Once CDC receives 
the extract, a confirmatory e-mail is submitted to the Contractor verifying that the extract has been 
received. The Contractor shall contact the COR if the confirmatory e-mail is not received. The COR 
will contact the Contractor if there is a problem uploading and processing the data. The Contractor 
shall adhere to the following: 


e Include initial report data and data obtained in follow up 

e Provide data in a format approved by the Government (CSV format) 

e Maintain manufacturer reports received electronically including postmarketing adverse drug 
reaction (ADR) data for individual cases, post marketing expedited ADR reports and periodic 
ADR reports. 


2. VAERS SARS-CoV-2 VACCINE PUBLIC EXTRACTS - The Contractor shall be required to 
maintain public redacted databases of VAERS data as specified by the Government. The current 
YAERS public website (www.vaers.hhs.gov) provides downloadable datasets that are subsets of the 
YAERS daily extract that is sent to the CDC and FDA. WONDER, a CDC created online tool located 
at wonder.cdc.goy, is another example of the public databases. This tool allows the public to query a 
subset of the VAERS data. Standard operating procedures are used to ensure patient privacy. The 
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public website and WONDER shall be updated on a weekly basis. There is a one week lag on data so that 
quality control measures can be conducted by the Contractor. The datasets on the public website are split 
into separate CSV files by years dating from 1990 to the current year. Non-domestic (i.e., foreign) reports 
are placed in a separate CSV file. 


3. WAERS SARS-CoV-2 VACCINE OTHER GOVERNMENTAL AGENCIES EXTRACTS- The 
Contractor shall provide Y AERS data in comma separated value (CSV) files on a secure server platform 
to specified points of contact among other governmental agencies, Department of Defense (DoD), 

Indian Health Services (IHS), and World Health Organization (WHO), on a weekly basis. 

a. DoD and non-DoD reports will be identified using specific search criteria as outlined in VAERS CDC 
DoD Memorandum of Agreement (MOA). Initial and follow-up unredacted information will be 
provided on DoD reports, while initial redacted information will be provided on non-DoD reports. 

b. IHS and non-JHS reports will be identified using specific search criteria as outlined in VAERS CDC 
IHS Memorandum of Understanding (MOU). Initial and follow-up unredacted information will be 
provided on IHS reports, while initial redacted information will be provided on non-IHS reports. 

c. WHO will be provided initial redacted information, similar to data publicly available at the CDC 
WONDER website: https://wonder.cdc.gov/vaers.html. 


4. VAERS SARS-CoV-2 VACCINE JURISDICITON EXTRACTS- The Contactor shall provide VAERS 
SARS-CoV-2 vaccine data and summary tables to specified jurisdictions using CDC’s Epidemic 
Information Exchange (£pi-X), a secure, web-based network that serves as a powerful information 
exchange between CDC and public health professionals involved in identifying, investigating, and 
responding to public health threats. Data will be posted and refreshed on a weekly basis with a one week 
lag in order to incorporate quality contro] measures conducted by the Contractor. The VAERS SARS- 
Co¥-2 vaccine data will include initial report data with personal identifiers, no follow-up will be 
included, Suminary tables will also be provided to the jurisdictions, including susnmary statistics, 
including but not limited to, serious status and conditions of interest. 


5. WAERS SARS-Co¥-2 Priority Report- The Contractor shall provide CDC and FDA with a daily email 
containing a breakdown of SARS-CoV-2 vaccine reports listing VAERS ID by manufacturer, serious 
status, and domestic/foreign country status. The contractor will also provide counts of reports, both daily 
and cumulative, by manufacturer, serious status, and domestic/foreign country status. 


VAERS FUTURE SOFTWARE DEVELOPMENT AND ENHANCEMENTS 


A. At the request of the Government, the Contractor shall develop and enhance software for the VAERS system 
following the HHS, CDC and NCEZID policies aud procedures for Euterprise Performance Life Cycle 
(EPLC), Capital Planning and Investment Control (CPIC) and IT security. 


http://www.hhs.gov/ocio/policy/index.html 


CONTRACTOR COMPLIANCE WITH APPLICABLE LAWS, REGULATIONS, POLICIES AND STANDARDS 


A. The Contractor shall ensure that the Information Technology Architecture (ITA) for the VAERS systern is 
implemented and maintained by the Contractor in compliance with applicable regulations including OMB 
Circular A-130, the Federal Information Resources Management Regulation (FIRMR), the DHHS Automated 
Information Systems Security Program (AISSP) Handbook, and applicable portions of the CDC ITA plan, 
Technical Reference Model and Standards. 


B. IT products and technologies procured through this contract shall meet the applicable accessibility standards 
at 36 CFR 1194, viewable at https://www.gpo.gov/fdsys/granule/CFR-201 1 -title36-vol3/CFR- 201 1 -tithe36- 


vol3-part! 194/content-detail. html 


C. The Contractor shall ensure that all systems are in compliance with Section 208, the privacy provisions of the 
E-Government Act of 2002, and follow the OMB Guidance of September 26, 2003 regarding implementation of 
the privacy provisions of the E-Government Act. 


D. The Contractor shall be responsible for being aware of and shall comply with all applicable federal 
information technology and information management laws, regulations, policies, and standards. These 
include but are not limited to: 


Children’s Online Privacy Protection Act (COPPA) 
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Section 508 of the Rehabilitation Act. HHS Section 508 Product Assessment Template (nse 


VPAT version 2.0 or later: https://www.itic.org/policy/accessibility/vpat ) 


Clinger-Cohen Act (CCA 


Paperwork Reduction Act (PRA 


Federal Information Security and Management Act (FISMA) 


Office of Management and Budget (OMB), National Institute of Standards and Technology 


(NIST), and General Accounting Office (GAO) policies that can be primarily found at or 
through the Federal CIO Council website at www.cio.gov. 
e Federal Enterprise Architecture (FEA) 


E. The Contractor shall not develop any Internet web applications that use persistent cookies without explicit 
authorization by CDC’s Chief Information Officer. 


F. The Contractor shall adhere to CDC’s Secure Coding Practices guide for developing web-based 


applications to prevent security vulnerabilities. 


G. Contractor's performance and resulting deliverables shal] adhere to all federal, HHS, and/or CDC IT 
security policies and procedures. Development or implementation of an electronic information system or 
any electronic data collection effort conducted in the performance of this contract is required to undergo 
Certification and Accreditation (C&A) prior to operation. When applicable, the Contractor shall be 
required to complete ali security documentation and materials required to obtain an authority to operate 
(ATO). The Contractor shall comply with all applicable HHS, CDC, FISMA, HIPPA, NIST, and other 
federal policies and regulations in the performance of the security requirements. If an application or system 
is operated by the Contractor on behalf of the Government and/or hosted at a Contractor facility, it shall 
comply with HHS and CDC policies, and is subject to all OMB regnirements, including a full Certification 


and Accreditation (C&A} 


Deliverable 


Program Management Monthly Status Report as 
specified in the Administrative section of the 
SOW 

Annual report as specified in the Administrative 
section of the SOW 


Draft Final Report as specified in the 
Administrative section of the SOW. 

Final Report as specified in the Administrative 
section of the SOW 


Report inventory of ail hardware and software, 
including version numbers of software and record 
of maintenance as specified in Security section of 
the SOW 

Develop/update and provide standard operating 
procedures for all aspects of VAERS operations, 
including complete YAERS report processing, as 
specified in the Administrative section of the 


V. TASK ORDER DELIVERABLES AND MILESTONES: 


Quantity 


l each to the 
COR and TR 


| each to the 

COR, TR and 
co 

l each to the 

COR and TR 

l each to the 

COR, TR and 
CO 

l each to the 

COR and TR 


| each to the 
COR and TR 


Monthly, first report due 30 days after 
contract award 


Annually, due 30 days following the 12 
months period covered by report 


At least 45 days before the contract 
completion date 


No later than the contract completion 
date 


Include in annual report and upon 
request 


Within 30 days after contract award, 
within 30 days of implementation of 
changes, and then annually and upon 
request 
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Develop and maintain list of names, phone 
numbers, fax numbers, and email addresses of 
contact personnel responsible for reporting from 
state health agencies, vaccine manufacturers, and 
immunization programs as specified in 
Administrative section of the SOW 

Report number, method of contact, type of contact 
with VAERS by manufacturers, state health 
coordinators, immunization programs, and the 
public. 

Provide documentation of the technical procedure 
for data transport to Government as specified in the 
Information Management section of the SOW. 
Provide Government Extract of VAERS data to 
both agencies as specified in the Information 
Management section of the SOW. 

Maintain and provide documentation for a 
current, separate mirror version of the VAERS 
system and RDBMS as specified in SOW. 
Provide user-procedure manual(s) and standard 
operating procedures (manual of operations) for 
technical aspects of VAERS database operations 
Provide documentation for data verification 
procedures including standardized letters, forms, 
logs, phone scripts and other documents as 
specified in SOW 

Provide a weekly report of adverse events after 
SARS-Co¥-2 vaccines to Vaccine Safety 
Coordinators and their designees of specific 
jurisdictions as indicated by the Government as 
specified in SOW 

Provide documentation for procedures and rules 
for Data Quality Control and Assurance as 
specified in SOW 

Provide System Security Plan and training 
materials for employee AIS security training 
program as specified in the Information 
Management section of the SOW 

Provide Program Management Plan as specified 
in the Administrative section of the SOW 
Provide Quality Assurance Program (QAP) plan 
as specified in SOW 


Provide list of key project personnel as specified 
in SOW 


| each to the 
COR and TR 


l each to the 
COR and TR 


l each to the 
COR and TR 


| each to FDA 
and CDC 
designees 

1 Each to the 

COR and TR 


L each to the 
COR and TR 


1 each to the 
COR and TR 


1 each to the 
COR and TR 


| each to the 
COR and TR 


l each to the 
COR and TR 


I each to the 

COR and TR 

| each to the 

COR, TR and 
CO 

| each to the 

COR, TR and 


Within 30 days after contract award, 
then annually, and upon Government 


request. 


Include in the annual report, and upen 


Government request 


Within 30 days after contract award 


Beginning 30 days after contract award, 
and each business day thereafter 


Within 90 days after contract award 


30 days after contract award and then 


as specified in SOW 


Upon Government request 


Weekly, beginning 60 days after 


contract award 


Provide 60 days after contract award 
then annually or upon request 


Within 30 days after contract award, 


then annually 


Within 30 days after contract award, 
then annually or upon request 
Within 30 days after contract award, 


then annually 


Within 30 days after contract award, 
then annually: update within 10 days 
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Provide Earned Value Report as specified in 
Information Management and 

Administrative sections of SOW 

Provide Data System Security Plan or 
information system security plan (SSP) as 
specified in Information Management section of 
Provide list of staff who have successfully 
completed information security training as 
specified in Information Management section 
of SOW 

Provide documentation of Level 3 Security 
Requirements compliance as specified in 

the Information Management section of 
Provide Transition-Out Plan for approval as 
specified in the Administrative section of 
Provide Disaster Recovery Plan for approval as 
specified in the Information Management 
section of SOW 

Provide results of IT Security Risk 
Management Assessment as specified in the 
Information Management section of SOW 
Provide the Government with detailed system 
documentation. Documentation shail be 
maintained in two separate volumes: “Volume 
1 

— VAERS Business Processes” and “Volume 2 
— VAERS IT Requirements and Design” as 
Provide detailed documentation of the technical 
procedures for data transport to CDC and FDA 
as specified in the Administrative section of 
SOW 

Provide Priority Report of VAERS data to CDC 
and FDA as specified in the Information 
Management section of the SOW. 


CO 
I each to the 
COR and 
TR 
t each to the 
CO and 
COR 

1 to COR 


1 each to 
COR and 
TR 

l each to the 

COR and 

l each to the 
COR and 
TR 

l each to the 
COR and 
TR 

1 each to the 
COR and 
TR 


l each to the 
COR and 
TR 


I each to 
FDA and 
CDC 
designees 


following key personnel changes 
Include in monthly reports 


Draft within 30 days after contract 
award; final version within 60 
days after award. 

Upon request by COR 


Within 30 days after contract award 


Within 60 days after contract award 


Within 60 days after contract award 


Within 45 days of 
completed assessment 


Within 30 days after contract 
award, then annually thereafter, 
with new sections or documentation 
revisions provided within 10 days 


Within 30 days after contract 
award, then annually thereafter, 
with new sections or documentation 
revisions provided within 10 days 
Beginning 30 days after contract 
award, and each business day 
thereafter 


The Contractor shall provide, upon request from the Government, deliverables not specifically listed in this 
document. The Governinent will provide the Contractor with sufficient time {i.e., a miniinum of 2 business 
days) to fulfill such requests, 


VI. PERFORMANCE MATRIX: 


| COR oversight 
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Execute/perform | Meets and All required tasks, 100% Favorable or 
all required tasks | complies with | milestones and compliance Unfavorable 
according to defined task deliverables will be Performance 
performance plan | requirements | achieved within the Evaluation 
agreed-upon 
schedule specified in 
this Statement of 
| Work 
Send timely | Each business All required tasks, 98% Daily receipt of | Favorable or 
VAERS Daily day the milestones and compliance Extract Unfavorable 
Extracts with Contractor deliverables will be Performance 
correct sends an achieved within the Evaluation 
information extract to the | agreed-upon 
CDC and schedule specified in 
FDA through | this Statement of 
the PHINMS | Work 
or other 
specified 
application. 
Process all Process All required tasks, 100% Y Favorable or 
serious reports serious milestones and compliance Quality Reports | Unfavorable 
within the reports in the | deliverables will be All late Performance 
specified established achieved within the logging of Evaluation 
timeframe timeframe to | agreed-upon adverse 
reflected in electronically | schedule specified in | events 
Appendix A of migrate VAE | this Statement of reports is 
this SOW. data into the Work reported in 
database. monthly 
report. 


VIL PERIOD OF PERFORMANCE: 


The period of performance shall be for twelve (12) months after date of award. 


VII. PLACE OF PERFORMANCE: 
The work will be conducted at the contractor’s facility. 


IX. EQUIPMENT AND INFORMATION: 

The Contractor shall provide hardware, software, office and communications equipment and other resources to be 
used for data receipt, processing, editing, analysis, reporting, transmission, and storage. The Contractor shall 
provide the Government with current and detailed system documentation, including SOPs for all aspects of VAERS 
program operations, including complete VAERS report processing, submitted to the Government for initial review 
and approval within 30 days after contract award and within 30 days of revision or implementation of changes, and 
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minimally on an annual basis or as requested by the Government thereafter. Please see Task Order 1 
(Administrative) for more detail. 


Appendix A: VAERS triaging of reports in business days!:* 


Serious reports Serious follow-up 


| initiation 
Sean within Complete 
process 
pi h . 3 


1. US Deaths* 


[2 US 5-day repos | SCD 
(30S Slay repos | 2) o vA 


1. Subject to change in response to new public health policies and/or events and/or funding availability after discussion 

between CDC and FDA 

2. Not applicable for GBS reports where a patient is confined to facility longer than the time allowed for follow-up (e.g. 

patient in rehabilitation after GBS) 

3. Completion includes scanning, data entry, and coding 

4. If final autopsy report is not received within 2 months, make request every 2 months 

5. If no records received within 5 days from the original request, make additional requests for COVID-19 up to 3 months. 
After 3 months of unsuccessful attempts, close out case unless patient remains hospitalized. 


SPECIAL CONSIDERATIONS 


352.239-74 Electronic and Information Technology Accessibility (December 18, 2015) 


(a) Pursuant to Section 508 of the Rehabilitation Act of 1973 (29 U.S.C. 794d), as amended by the Workforce 
Investment Act of 1998, all electronic and information technology (EIT) supplies and services developed, acquired, 
or maintained under this contract or order must comply with the “Architectural and Transportation Barriers 
Compliance Board Electronic and Information Technology (EIT) Accessibility Standards” set forth by the 
Architectural and Transportation Barriers Compliance Board (also referred to as the “Access Board”) in 36 CFR part 


1194. Information about Section 508 is available at http://www.hhs.gov/web/508. The complete text of Section 


508 Final Provisions can be accessed at http://www.access-board.gov/guidelines-and- 
standards/communications-and-it/about-the-section-508-standards. 


(b) The Section 508 accessibility standards applicable to this contract or order are identified in the Statement of 
Work or Specification or Performance Work Statement. The contractor must provide any necessary updates to the 
submitted HHS Product Assessment Tempiate(s} at the end of each contract or order exceeding the simplified 
acquisition threshold (see FAR 2.101) when the contract or order duration is one year or less. If it is determined 
by the Government that EIT supplies and services provided by the Contractor do not conforin to the described 
accessibility standards in the contract, remediation of the supplies or services to the level of conformance specified 
in the contract will be the responsibility of the Contractor at its own expense. 


(c) The Section 508 accessibility standards applicable to this contract are: 1194. 


205 WCAG 2.0 Level A & AA Success Criteria 
302 Functional Perforinance Criteria 
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502 Inoperability with Assistive Technology 
504 Authoring Tools 

602 Support Docnmentation 

603 Support Services 


(d) In the event of a modification(s) to this contract or order, which adds new EIT supplies or services or revises the 
type of, or specifications for, supplies or services, the Contracting Officer may require that the contractor snbimit a 
completed HHS Section 508 Product Assessment Template and any other additional information necessary to assist 
the Governinent in determining that the EIT snpplies or services conform to Section 508 accessibility standards. 
Instrnctions for documenting accessibility via the HHS Section 508 Product Assessment Template may be found 
under Section 508 policy on the HHS website: (http://www.hhs.gov/web/508). If it is determined by the 
Government that EIT supplies and services provided by the Contractor do not conform to the described accessibility 
standards in the contract, remediation of the supplies or services to the level of conformance specified in the contract 
will be the responsibility of the Contractor at its own expense. 


(e) If this is an Indefinite Delivery contract, a Blanket Purchase Agreement or a Basic Ordering Agreement, the 
task/delivery order requests that include EIT supplies or services will define the specifications and accessibility 
standards for the order. In those cases, the Contractor may be required to provide a completed HHS Section 508 
Product Assessment Template and any other additional! information necessary to assist the Government in 
determining that the EIT supplies or services conform to Section 508 accessibility standards. Instructions for 
documenting accessibility via the HHS Section 508 Product Assessment Template may be found 

at http://www.hhs.gov/web/508. If it is determined by the Government that EIT supplies and services provided 
by the Contractor do not conform to the described accessibility standards in the provided documentation, 
remediation of the supplies or services to the level of conformance specified in the contract will be the responsibility 
of the Contractor at its own expense. 


(End of clause) 
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SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS 
VAERS SAR-CoV-2 Increased Capacity: Period of Performance 03/05/2021 to 08/31/2021 


ITEM SUPPLIES / SERVICES TY /UNIT | UNITPRICE _| NOT TO EXCEED 


VAERS SAR-CoV-2 aa a) 
Increased Capacity 

The contractor shall provide CDC and 
FDA technical and programmatic support 
to collect and analyze information on 
vaccine adverse events (VAEs). and 
facilitate reporting to VAERSspecifically 
pertaining to SARS-CoV-2. Reference the 
SOW and all associated deliverables. This 
line item is based an expectation of 
25,000 reports per week to be cleared 
over a 6-month period. 

This is a T&M, severable line item. 

See Table B.2 for LOE 

PoP: 03/05/2021 — 08/31/2021 


2001 Line(s) Of Accounting: 
S390GLY 2512 2021 75-2124-0943 C5B8111101 (Ci 
2002 


VAERS SAR-CoV-2 E- Ses 
Increased Capacity ODCs 

All travel must be in accordance with the 
Federal Travel Regulations (FTR). The 
Contractor shall obtain COR pre-approval 
of estimated travel expenses prior to 
travel occurrence. Charges will be 
submitted for actual costs incurred. The 
contractor shall ensure that the requested 
travel costs will not exceed the amount 
authorized in this task order. 

Other direct costs include travel, 
approved training requirements, and items 
shown in table B.3. All other direct costs 
must be pre-approved by the CO and 
COR prior to occurrence. 

T&M, severable line item 

See Table B.3 approved ODCs 

PoP: 03/05/2021 — 08/31/2021 


2002 Line(s) Of Accounting: 
9390GLY 2512 2021 75-2124-0943 C5B8111101 (b)(4) 
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VAERS SAR-CoV-2 Es ey 
Increased Capacity CAF 


The Contract Access Fee (CAF) is 0.75% 
to be applied to the total price for 
contractor performance as billed to the 
government on each Task Order. The 
CAF is paid by the Ordering Agency, but 
remitted to GSA by the Contractor. Based 
on the established CAF rate, the 
Contractor shall include the CAF in each 
proposal. The Contractor shall include the 
CAF as a separate cost element per year 
on all quotes to the government, 
regardless of contract type. The CAF 
shall never be treated as a negotiable 
element between the Contractor and the 
Ordering Agency. The CAF Rate, 
effective at time of the Task Order award, 
shali remain the same for that Task Order 
for the full term of the Order. 


Not to Exceed a Total of $L50K for 
orders with total value greater than $20M 
per year 


PoP: 03/05/2021 — 08/31/2021 


2003 Line(s) Of Accounting: 
9390GLY 2512 2021 75-2124-0943 CSB8111101 


Task Order Total: (b)(4) 
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SECTION B.2 — Level of Effort for Baclog and Increased Capacity 


Backlog 25,000 Reports 
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STATEMENT OF WORK FOR 
VACCINE ADVERSE EVENT REPORTING SYSTEM 
(VAERS) FOR SARS-COV-2 VACCINES 


IV. DESCRIPTION OF WORK: 

a. The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (YAE) 
reports after SARS-CoV-2 vaccines. The total number of reports received during periods of peak activity 
(which are not expected to reflect sustained activity) is expected to be 1,000 reports per day, with up to 40% 
of the reports serious in nature. This constitutes the base capacity expectation of up to 5,000 reports per 
week. 


b. The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (VAE) 
reports after SARS-CoV-2 vaccines to clear the backlog of SARS-CoV-2 VAE reports that has been 
projected to accumulate through February 28, 2021. The contractor shall prioritize clearing the backlog of 
reports al the direction of the Government. The backlog shall be processed and cleared within 3—6 months 
from the start of March 2021. (refer to “ACKNOWLEDGMENT, VERIFICATION, CODING AND DATA 
COLLECTION FOR ADVERSE EVENTS REPORTED AFTER SARS-CoV-2 VACCINES” Section C; 3a, 
3b, 3c, and 3d). 
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Except as provided herein, all terms and conditions of the document referenced in Item $A or 10A, as heretofore changed, remains unchanged and in full force and effect. 
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SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS 


VAERS SAR-CoV-2 Increased Capacity: Period of Performance 03/01/2021 to 02/28/2022 


VAERS SAR-CoV-2 

Increased Capacity 

The contractor shall provide CDC and 
FDA technical and programmatic support 
to collect and analyze information on 
vaccine adverse events (VAEs). and 
facilitate reporting to VAERS specifically 
pertaining to SARS-CoV-2. Reference the 
SOW and all associated deliverables, 
This line item is based an estimation of a 
minimum of 25,000 extra reports per 
week to be cleared in 6 months from 
03/01/2021 - 08/31/2021, then reduce 
efforts through September to a 
minimum of 13,000 extra reports per 
week from 10/01/2021 to 02/28/2022. 


This is a T&M, severable line item. 

See Table B.2 

PoP: 03/01/2021 — 02/28/2022 

VAERS SAR-CoV-2 

Increased Capacity ODCs 

All travel must be in accordance with the 
Federal Travel Regulations (FTR). The 
Coniractor shall obtain COR pre-approval 
of estimated travel expenses prior to 
travel occurrence. Charges will be 
submitted for actual costs incurred. The 
contractor shall ensure that the requested 
travel costs will not exceed the amount 
authorized in this task order. 


Other direct costs include travel, 
approved training requirements, and items 
shown in table B.3. All other direct costs 
must be pre-approved by the CO and 
COR prior to occurrence. 


T&M, severable line item 
See Table B.3 
PoP: 03/01/2021 — 02/28/2022 
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VAERS SAR-CoV-2 
Increased Capacity CAF 

The Contract Access Fee (CAF) is 0.75% 
to be applied to the total price for 
contractor performance as billed to the 
government on each Task Order. The 
CAF is paid by the Ordering Agency, but 
remitted to GSA by the Contractor. Based 
on the established CAF rate, the 
Contractor shall include the CAF in each 
proposal. The Contractor shall include the 
CAF as a separate cost element per year 
on all quotes to the government, 
regardless of contract type. The CAF 
shall never be treated as a negotiable 
element between the Contractor and the 
Ordering Agency. The CAF Rate, 
effective at time of the Task Order award, 
shall remain the same for that Task Order 
for the full term of the Order. Not to 
Exceed a Total of $150K for orders with 
total value greater than $20M per year 
PoP: 03/01/2021 — 02/28/2022 


Task Order Total: 
SECTION B.2 — Level of Effort for Increased Capacity 


(b)(4) 


October 2021 — February 2022 


(b\(4) 
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{b)(4) 


CLIN 2002 


(b)(4} 
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STATEMENT OF WORK FOR 
VACCINE ADVERSE EVENT REPORTING SYSTEM 
(VAERS) FOR SARS-COV-2 VACCINES 


IV. DESCRIPTION OF WORK: 

a. The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (VAE) 
reports after SARS-Co¥V-2 vaccines. The total number of reports received during periods of peak activity 
(which are not expected to reflect sustained activity) is expected to be 1,000 reports per day, with up to 40% 
of the reports serious in nature. This constitutes the base capacity expectation of up to 5,000 reports per 


b. The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (VAE) 
reports after SARS-Co¥V-2 vaccines to clear the backlog of SARS-CoV-2 VAE reports that has been 
projected to accumulate through February 28, 2021. The contractor shall prioritize clearing the backlog of 
reports at the direction of the Government. The domestic report backlog shall be processed and cleared 
within 3 months from the start of the March 2021. The foreign report backlog shall be processed and cleared 
within 3-6 months from the start of the March 2021. (refer to “ACKNOWLEDGMENT, VERIFICATION, 
CODING AND DATA COLLECTION FOR ADVERSE EVENTS REPORTED AFTER SARS-Co¥V-2 
VACCINES” Section C; 3a, 3b, 3c, and 3d). 


CLIN 2001, 2002, and 2003) shall be 


c The contractor’s staffing and operations for increased capacity 
sufficient to fully process within specified 


with up to 30% of the reports 
classified as serious. 


Description of Effort Period of Time Estimated LoE invoice value 


(bX4}) 
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52.232-7 Payments under Time-and-Materials and Labor-Hour Contracts (Aug 2012) 


The Government will pay the Contractor as follows upon the submission of vouchers approved by the Contracting 
Officer or the authorized representative: 


{a) Hourly rate. (1) Hourly rate means the rate(s) prescribed in the contract for payment for labor that meets the 
labor category qualifications of a labor category specified in the contract that are- 
G) Performed by the Contractor; 


Gi) Performed by the subcontractors; or 
{iii) Transferred between divisions, subsidiaries, or affiliates of the Contractor under a common control. 


{2) The amounts shall be computed by multiplying the appropriate hourly rates prescribed in the Schedule by 
the number of direct labor hours performed. 


{3) The hourly rates shall be paid for all labor performed on the contract that meets the labor qualifications 
specified in the contract. Labor hours incurred to perform tasks for which labor qualifications were specified in the 
contract will not be paid to the extent the work is performed by employees that do not meet the qualifications 
specified in the contract, unless specifically authorized by the Contracting Officer. 


(4) The hourly rates shall include wages, indirect costs, general and administrative expense, and profit. 
Fractional parts of an hour shall be payable on a prorated basis. 


(5) Vouchers may be submitted not more than once every two weeks, to the Contracting Officer or authorized 
representative. A small business concern may receive more frequent payments than every two weeks. The 
Contractor shall substantiate vouchers (including any subcontractor hours reimbursed at the hourly rate in the 
schedule) by evidence of actual payment and by- 


(i) Individual daily job timekeeping records; 


Gi) Records that verify the employees meet the qualifications for the labor categories specified in the 
contract; or 


Gii) Other substantiation approved by the Contracting Officer. 


(6) Promptly after receipt of each substantiated voucher, the Government shall, except as otherwise provided 
in this contract, and subject to the terms of paragraph (e) of this clause, pay the voucher as approved by the 
Contracting Officer or authorized representative. 


(7) Uniess otherwise prescribed in the Schedule, the Contracting Officer may unilaterally issue a contract 
modification requiring the Contractor to withhold amounts from its billings until a reserve is set aside in an amount 
that the Contracting Officer considers necessary to protect the Government's interests, The Contracting Officer may 
require a withhold of 5 percent of the amounts due under paragraph (a) of this clause, but the total amount withheld 
for the contract shall not exceed $50,000. The amounts withheld shall be retained until the Contractor executes and 
delivers the release required by paragraph (g} of this clause. 


(8) Unless the Schedule prescribes otherwise, the hourly rates in the Schedule shall not be varied by virtue of 
the Contractor having performed work on an overtime basis. If no overtime rates are provided in the Schedule and 
overtime work is approved in advance by the Contracting Officer, overtime rates shall be negotiated. Failure to 
agree upon these overtime rates shall be treated as a dispute under the Disputes clause of this contract. If the 
Schedule provides rates for overtime, the premium portion of those rates will be reimbursable only to the extent the 
overtime is approved by the Contracting Officer. 


{b) Materials. (1) For the purposes of this clause- 
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(i) Direct materials means those materials that enter directly into the end product, or that are used or 
consnmed directly in connection with the furnishing of the end product or service. 


(ii) Materials means- 


(A) Direct materials, including supplies transferred between divisions, subsidiaries, or affiliates of the 
Contractor under a common control; 


(B) Subcontracts for supplies and incidental services for which there is not a labor category specified in 
the contract; 


{C) Other direct costs (e.g., incidental services for which there is not a labor category specified in the 
contract, travel, computer usage charges, eic.); and 


{D) Applicable indirect costs. 

{2) If the Contractor furnishes its own materials that meet the definition of a commercial item at 2.101, the 
price to be paid for such materials shall not exceed the Contractor's established catalog or market price, adjusted to 
reflect the- 

{#) Quantities being acquired; and 


Gi) Actual cost of any modifications necessary because of contract requirements. 


(3) Except as provided for in paragraph (b)(2) of this clause, the Government will reimburse the Contractor 
for allowable cost of materials provided the Contractor- 


(G) Has made payments for materials in accordance with the terms and conditions of the agreement or 
Invoice; or 


Gi) Ordinarily makes these payments within 30 days of the submission of the Contractor's payment request 
to the Government and such payment is in accordance with the terms and conditions of the agreement or invoice. 


{4) Payment for materials is subject to the Allowable Cost and Payment clause of this contract. The 
Contracting Officer will determine allowable costs of materials in accordance with subpart 31.2 of the Federal 
Acquisition Regulation (FAR) in effect on the date of this contract. 

(5) The Contractor may include allocable indirect costs and other direct costs to the extent they are- 

G) Comprised only of costs that are clearly excluded from the hourly rate; 
{ii) Allocated in accordance with the Contractor's written or established accounting practices; and 
(iii) Indirect costs are not applied to subcontracts that are paid at the hourly rates. 


{6) To the extent able, the Contractor shall- 


(i) Obtain materials at the most advantageous prices available with due regard to securing prompt delivery 
of satisfactory materials; and 


(ii) Take all cash and trade discounts, rebates, allowances, credits, salvage, commissions, and other 
benefits. When unable to take advantage of the benefits, the Contractor shall promptly notify the Contracting Officer 
and give the reasons. The Contractor shall give credit to the Government for cash and trade discounts, rebates, scrap, 
commissions, and other amounts that have accrued to the benefit of the Contractor, or wonld have accrued except 
for the fault or neglect of the Contractor. The Contractor shall not deduct from gross costs the benefits lost without 
fanlt or neglect on the part of the Contractor, or lost through fault of the Government. 


75D30120F09621 00005 
Page 8 of 9 


(7) Except as provided for in 31.205-26(e) and {f}, the Government will not pay profit or fee to the prime 
Contractor on materials. 


{c) If the Contractor enters into any subcontract that requires consent under the clause at 52.244-2, Subcontracts, 
without obtaining such consent, the Government is not required to reimburse the Contractor for any cosis incurred 
under the subcontract prior to the date the Contractor obtains the required consent. Any reimbursement of 
subcontract costs incurred prior to the date the consent was obtained shall be at the sole discretion of the 
Government. 


{d) Total cost. It is estimated that the total cost to the Government for the performance of this contract shall not 
exceed the ceiling price set forth in the Schedule, and the Contractor agrees to use its best efforts to perform the 
work specified in the Schedule and all obligations under this contract within such ceiling price. If at any time the 
Contractor has reason to believe that the hourly rate payments and material costs that will accrue in performing this 
contract in the next succeeding 30 days, if added to all other payments and costs previously accrued, will exceed 85 
percent of the ceiling price in the Schedule, the Contractor shall notify the Contracting Officer giving a revised 
estimate of the total price to the Government for performing this contract with supporting reasons and 
documentation. If at any time during performing this contract, the Contractor has reason to believe that the total 
price to the Government for performing this contract will be substantially greater or less than the then stated ceiling 
price, the Contractor shall so notify the Contracting Officer, giving a revised estimate of the total price for 
performing this contract, with supporting reasons and documentation. If at any time during performing this contract, 
the Government has reason to believe that the work to be required in performing this contract will be substantially 
greater or less than the stated ceiling price, the Contracting Officer will so advise the Contractor, giving the then 
revised estimate of the total amount of effort to be required under the contract. 


{e) Ceiling price. The Government will not be obligated to pay the Contractor any amount in excess of the 
ceiling price in the Schedule, and the Contractor shall not be obligated to continue performance if to do so would 
exceed the ceiling price set forth in the Schedule, unless and until the Contracting Officer notifies the Contractor in 
writing that the ceiling price has been increased and specifies in the notice a revised ceiling that shall constitute the 
ceiling price for performance under this contract. When and to the extent that the ceiling price set forth in the 
Schedule has been increased, any hours expended and material costs incurred by the Contractor in excess of the 
ceiling price before the increase shall! be allowable to the same extent as if the hours expended and material costs 
had been incurred after the increase in the ceiling price. 


{D Audit. At any time before final payment under this contract, the Contracting Officer may request audit of the 
vouchers and supporting documentation. Each payment previously made shall be subject to reduction to the extent 
of amounts, on preceding vouchers, that are found by the Contracting Officer or authorized representative not to 
have been properly payable and shall also be subject to reduction for overpayments or to increase for 
underpayments. Upon receipt and approval of the voucher designated by the Contractor as the "completion voucher" 
and supporting documentation, and upon compliance by the Contractor with all terms of this contract (including, 
without limitation, terms relating to patents and the terms of paragraph (g) of this clause), the Government shall 
promptly pay any balance due the Contractor. The completion voucher, and supporting documentation, shall be 
submitted by the Contractor as promptly as practicable following completion of the work under this contract, but in 
no event later than 120 days {or such longer period as the Contracting Officer may approve in writing) from the date 
of completion. 


{2) Assignment and Release of Claims. The Contractor, and each assignee under an assignment entered into 
under this contract and in effect at the time of final payment under this contract, shall execute and deliver, at the 
time of and as a condition precedent to final payment under this contract, a release discharging the Government, its 
officers, agents, and employees of and from all liabilities, obligations, and claims arising out of or under this 
contract, subject only to the following exceptions: 


(1) Specified claims in stated amounts, or in estimated amounts if the amounts are not susceptible of exact 
statement by the Contractor. 
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(2) Claims, together with reasonable incidental expenses, based npon the liabilities of the Contractor to third 
parties arising ont of performing this contract, that are not known to the Contractor on the date of the execntion of 
the release, and of which the Contractor gives notice in writing to the Contracting Officer not more than 6 years after 
the date of the release or the date of any notice to the Contractor that the Government is prepared to make final 
payment, whichever is earlier. 


(3) Claims for reimbursement of costs (other than expenses of the Contractor by reason of its indemnification 
of the Government against patent liability), including reasonable incidental expenses, incurred by the Contractor 
under the terms of this contract relating to patents. 


th) interim payments on contracts for other than services. (1) Interim payments made prior to the final payment 
under the contract are contract financing payments. Contract financing payments are not subject to the interest 
penalty provisions of the Prompt Payment Act. 

(2) The designated payment office will make interim payments for contract financing on the 

{Contracting Officer insert day as prescribed by agency head; if not prescribed, insert "30th"] day after the 
designated billing office receives a proper payment request. In the event that the Government requires an audit or 
other review of a specific payment request to ensure compliance with the terms and conditions of the contract, the 
designated payment office is not compelled to make payment by the specified due date. 


(i) Interim pavinents on contracts for services. For interim payments made prior to the final payment under this 


contract, the Government will make payment in accordance with the Prompt Payment Act (31 U.S.C. 3903) and 
prompt payment regulations at 5 CFR part 1315, 


(End of clause) 
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The following modifications are hereby made via 75D30120F09621 00006 and apply thereafter: 


A. 


G. 


Recognize the Novation Agreement completed on May 27, 2021 between the Defense 
Contract Management Agency (DCMA) and General Dynamics Information Technology 
(GDIT), Inc., the successor-in-interest of CSRA, LLC, the signed modification and 
Novation Agreement between DCMA and GDIT is included as a relevant attachment; 


Update the SOW standard certification requirement from “CMM Level 3” to “CMMI Level 
3 or industry equivalent” throughout the task order; 


. Update the SOW as highlighted below to account for the VAERS SARS-Cov-2 Increased 


Capacity, minimum 13,000 extra reports per week (18,000 total) for the period of 
03/01/2022 to task order end-date of 08/26/2022; 


. Add and fully fund CLIN 3001 Increased Capacity, PoP 03/01/2022 to 08/26/2022, in the 


amount of (b)(4) 


Add and fully fund CLIN 3002 Increased Capacity ODCs, PoP 03/01/2022 to 08/26/2022, 
in the amount of 


Add and fully fund CLIN 3003 CAF, PoP 03/01/2022 to 08/26/2022, in the amount of 


Increase total contract value and funded amount by from (b)(4) to 
(b)(4) 


Except as provided herein, all terms and conditions of the document referenced in Item 9A or 
10A, as heretofore changed, remains unchanged and in full force and effect. 
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SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS 
VAERS SAR-CoV-2 Increased Capacity: Period of Performance 03/01/2022 to 08/26/2022 (end of task order) 


ITEM SUPPLIES / SERVICES QTY / UNIT UNIT PRICE | EXTENDED PRICE 


3001 VAERS SARS-Co¥V-2 
Increased Capacity until end of task 
order. 
The contractor shall provide CDC and 
FDA technical and programmatic support 
to collect and analyze information on 
vaccine adverse events (VAEs), and 
facilitate reporting to VAERS specificaily 
pertaining to SARS-CoV-2. Reference the 
SOW and all associated deliverables. 
This line item is based an estimation of a 
minimun of 13,000 extra reports per 
week to be cleared for 6-months from 
03/01/2022 - 08/26/2022. 
This is a T&M, severable line item. 
See Table B.2 
PoP: 03/01/2022 — 08/26/2022 


3001 Line(s) Of Accounting: 

9390GLY 2512 2022 75-2124-0943 C5B8111101 
VAERS SARS-Co¥-2 

Increased Capacity ODCs 


All travel must be in accordauce with the 
Federal Travel Regulatious (FTR). The 
Contractor shall obtain COR pre-approval 
of estimated travel expenses prior to 
travel occurrence. Charges will be 
submitted for actual costs incurred. The 
contractor shall ensure that the requested 
travel costs will not exceed the amount 
authorized in this task order. 


Other direct costs include travel. 
approved training requirements, and items 
shown in table B.3. All other direct costs 
must be pre-approved by the CO and 
COR prior to occurrence. 


T&M, severable line item 
See Table B.3 
PoP: 03/01/2022 — 08/26/2022 


3002 Line(s) Of Accounting: 
9390GLY 2512 2022 75-2124-0943 C5B8111101 


3003 


VAERS SARS-Co¥-2 
Increased Capacity CAF 


The Contract Access Fee (CAF) is 0.75% 
to be applied to the total price for 
contractor performance as billed to the 
government on cach Task Order. The 
CAF is paid by the Ordering Agency, but 
remitted to GSA by the Contractor. Based 
on the established CAF rate, the 
Contractor shall include the CAF in each 
proposal. The Contractor shall include the 
CAF as a separate cost element per year 
on all quotes to the government, 
regardless of contract type. The CAF 
shall never be treated as a negotiable 
element between the Contractor and the 
Ordering Agency. The CAF Rate, 
effective at time of the Task Order award, 
shall remain the same for that Task Order 
for the full term of the Order. Not to 
Exceed a Total of $150K for orders with 
total value greater than $20M per year. 


PoP: 03/01/2022 — 08/26/2022 
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(b)(4) 


3003 Line(s) Of Accounting: 


9390GLY 2512 2022 75-2124-0943 CSB8111101 (b)(4) 


Task Order Total: (b)(4) 
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SECTION B.2 — Level of Effort for Increased Capacit 


March 01, 2022 — August 26, 2022 


| e | Mears l 


(b)(4) 


SECTION B.3 — ODCs for CLIN 3002 
a aes Ce 
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STATEMENT OF WORK FOR 
VACCINE ADVERSE EVENT REPORTING SYSTEM 
(VAERS) FOR SARS-COV-2 VACCINES 


IV. DESCRIPTION OF WORK: 

a. The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (VAE) 
reports after SARS-CoV-2 vaccines. The total number of reports received during periods of peak activity 
(which are not expected to reflect sustained activity) is expected to be 1,000 reports per day, with up to 40% 
of the reports serious in nature. This constitutes the base capacity expectation of up to 5,000 reports per 
week (CLIN 0001, 0002, and 0003). 


b. The contractor shall implement a staffing and operations plan focusing only on vaccine adverse event (VAE) 
reports after SARS-CoV-2 vaccines to clear the backlog of SARS-Co¥-2 VAE reports that has been 
projected to accumulate through February 28, 2021. The contractor shall prioritize clearing the backlog of 
reports al the direction of the Government. The domestic report backlog shall be processed and cleared 
within 3 months from the start of the March 2021. The foreign report backlog shall be processed and cleared 
within 3-6 months from the start of the March 2021. (refer to “ACKNOWLEDGMENT, VERIFICATION, 
CODING AND DATA COLLECTION FOR ADVERSE EVENTS REPORTED AFTER SARS-CoV-2 
VACCINES” Section C; 3a, 3b, 3c, and 3d). 


c. The contractor’s staffing and operations for increased capacity (CLIN 2001, 2002, and 2003) shall be 
sufficient to fully process within specified timelines a minimum of 20,000 extra reports per calendar week 
(25,000 total) for a 6-month period from March 01, 2021 to August 31, 2021, with up to 30% of the reports 
classified as serious. No additional funding is to be allocated, but work is estimated continue with a decrease 
from the average pace established in the initial 6-month period throughout September 2021 to an estimated 
minimum of 13,000 extra reports per calendar week (18,000 total) for the 5-month period from October 01, 
2021 to February 28, 2022 or until such time as funds for CLIN 2001, 2002, and 2003 are invoiced * if the 
Government need for weekly reports exceeds the estimated minimum. 


*FAR 52.232-7 Payments under Time-and_Materials and Labor-Hour Contracts — see (d) Total cost. 


CLIN 2001 


Description of Effort Period of Time Estimated LoE invoice value 


(b)(4) 


CLIN 3001 


Description of Effort Period of Time Estimated LoE invoice value 
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8. NAME AND ADDRESS OF CONTRACTOR (No., street, county, State and ZIP Code) (J) | 9A. AMENDMENT OF SOLICITATION NO. 


GENERAL DYNAMICS INFORMATION TECHNOLOGY, INC. 
3150 FAIRVIEW PARK DR STE 100 


9B. DATED (See item 11) 
FALLS CHURCH, VA 22042-4504 


10A. MODIFICATION OF CONTRACT/ORDER NO. 
75D30120F09621 


10B. DATED (See item 13) 


x 
CODE SMNWMGHNT3XS — 08/27/2020 


11. THIS ITEM ONLY APPLIES TO AMENDMENTS OF SOLICITATIONS 


=} The above numbered solicitation is amended as set forth in Item 14. The hour and date specified for receipl of Offers __ is extended, ___ is not extended. 
Offers must acknowledge receipt of this amendment prior to the hour and date specified in the solicitation or as amended, by one of the following methods: 


(a) By completing Items 8 and 15, and returning copies of the amendment; (b) By acknowledging receipt of this amendment on each copy of the offer 
submitted; ar (c) By separate letter or telegram which includes a reference to the solicitation and amendment numbers. FAILURE OF YOUR ACKNOWLEDGMENT 
TO BE RECEIVED AT THE PLACE DESIGNATED FOR THE RECEIPT OF OFFERS PRIOR TO THE HOUR AND DATE SPECIFIED MAY RESULT 

IN REJECTION OF YOUR OFFER. If by virtue of this amendment you desire to change an offer already submitted, such change may be made by telegram or letter, 
provided each telegram or letter makes reference to the solicitation and this amendment, and is received prior to the opening hour and date specified. 

12. ACCOUNTING AND APPROPRIATION DATA (If required) 

N/A 


13. THIS ITEM APPLIES ONLY TO MODIFICATIONS OF CONTRACTS/ORDERS, 
IT MODIFIES THE CONTRACT/ORDER NO. AS DESCRIBED IN ITEM 14. 


{vj JA. THIS CHANGE ORDER IS ISSUED PURSUANT TO: (Specify authority) THE CHANGES SET FORTH IN ITEM 14 ARE MADE IN THE CONTRACT ORDER NO. IN 
ITEM 10A, 


B. THE ABOVE NUMBERED CONTRACT/ORDER IS MODIFIED TO REFLECT THE ADMINISTRATIVE CHANGES (such as changes in paying office, appropriation date, 
etc.) SET FORTH IN ITEM 14, PURSUANT TO THE AUTHORITY OF FAR 43.103{b). 


C. THIS SUPPLEMENTAL AGREEMENT IS ENTERED INTO PURSUANT TO AUTHORITY OF: 


D. OTHER (Specify type of modification and authority) 


2 Bilateral Modification to add HHSAR 352,232-71 Electronic Submission of Payment Requests 


E. IMPORTANT: Contractor E is not, is required to sign this document and return __1 _digilal copy to the issuing office. 


14. DESCRIPTION OF AMENDMENT/MODIFICATION (Organized by UCF section headings, including solicitation/contract subject matter where feasible.} 


The purpose of this bilateral administrative modification 00004 is to add HHSAR 352,232-71 Electronic 
Submission of Payment Requests to the contract and to trigger payment of invoices via www.ipp.gov. 


Except as provided herein, all terms and conditions of the document referenced in ltem 9A or 10A, as heretofore changed, remains unchanged and in full force and effect. 


15A. NAME AND TITLE OF SIGNER (Type or print) 16A. NAME OF CONTRACTING OFFICER 
Nathan R. Amador 
(b)(4) 
15B. CONTRACTOR/O ROR 15C. DATE SIGNED 166. UNITED STATES OF AMERICA 16C. DATE SIGNED 


(b)(4) BY _ Q Digitally signed by Nathan R. Amador -S 
Signatugé of person authdrized to sign) 22 APRIL 2022 (Signature of Contracting Ofiicerp ate" 2022.04.22 14:00:21 -04'00' 
NSN 7§40-01-152-8070 STANDARD FORM 30 (REV, 10-83) 
PREVIOUS EDITION UNUSABLE 30-105 Prescribed by GSA 


FAR (48 CFR) 53.243 


75D30120F0962! 00007 
Page 2 of 2 


SECTION B - SUPPLIES OR SERVICES AND PRICES/COSTS 


ITEM 


SUPPLIES / SERVICES 


QTY / UNIT UNIT PRICE NOT TO EXCEED 


0001 


VAERS SARS-CoV-2 

The contractor shall provide CDC and 
FDA technical and programmatic support 
to collect and analyze information on 
vaccine adverse events (VAEs), and 
facilitate reporting to WAERSspecifically 
pertaining to SARS-CoV-2. Reference the 
SOW and all associated deliverables. 


This is a T&M, severable line item. 


PoP: 08/27/2020 — 08/26/2022 


4 
(b)(4) 


HHSAR 352. 232-71 Electronic Submission of Payment Requests 


(a} Definitions. As used in this clause— 
Payment request means a bill, voucher, invoice, or request for contract financing payment with associated 
supporting documentation, The payment request must comply with the requirements identified in FAR 32.905{b), 
“Content of Invoices” and the applicable Payment clause included in this contract. 


(b) Except as provided in paragraph (c) of this clause, the Contractor shail submit payment requests 


electronically using the Department of Treasury Invoice Processing Platform {IPP} or successor system. 


Information regarding IPP, including IPP Customer Support contact information, is available 


at Www.ipp.goy or any successor site, 


(c} The Contractor may submit payment requests using other than IPP only when the Contracting Officer 


authorizes alternate procedures in writing im accordance with HHS procedures, 


id) If alternate payment procedures are authorized, the Contractor shall include a copy of the Contracting 


Officer's written authorization with each payment request. 


(END OF CLAUSE) 


